Blender EUVD-2026-114125

Exploitation requires a victim to open an attacker-supplied, specially crafted .blend file whose GLOB block is truncated, in a vulnerable Blender build (before 4.5.15, or 5.x before 5.2.3). The limiting factors are significant: the attack vector is local (AV:L) and requires user interaction (the file must be opened), no authentication is required (PR:N), and the outcome is only an application crash - there is no indication of code execution, privilege gain, or data disclosure. Realistic risk therefore depends on social engineering or asset-supply-chain delivery of the malicious file to a Blender user; it cannot be triggered remotely without that user action.

This is a medium-severity, availability-only issue, not a high-priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.8) describes a local, low-complexity flaw that requires the victim to open a crafted file, and the only impact is VA:H (availability) with VC:N and VI:N - i.e. a crash/DoS, not code execution or data disclosure. There is no exploitation in the wild: no KEV listing and no EPSS score are provided in the input, and no PoC is marked as confirmed, so this is best treated as no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month', consistent with a patch-on-normal-cycle priority rather than act_now/emergency. One conflict to flag: CWE-125 (out-of-bounds read) and the 'Information Disclosure' tag suggest a possible memory-read/leak, but the vendor-supplied vector sets VC:N and the description states only that Blender crashes - so the tag overstates confidentiality impact; verify with the vendor whether any heap contents are observable before treating this as an info-leak. Net: a real bug worth patching, but low real-world urgency because exploitation is local, needs user interaction, and yields only a crash.

An attacker crafts a malicious .blend file containing a truncated GLOB block and distributes it through a shared project, asset marketplace, or download where a 3D artist is likely to open it. When the victim opens the file in a vulnerable Blender, read_file_dna() reads the GLOB field past its declared length, triggering a heap out-of-bounds read that crashes the application. No confirmed public exploit code is identified in the provided data; impact is limited to denial of service (loss of the running session and any unsaved work).