Blender EUVD-2026-114127

Exploitation requires a victim to open or import an attacker-supplied, crafted .blend file in a vulnerable Blender build (before 4.5.15, or 5.x before 5.2.3). The specific trigger is a .blend file whose SDNA struct layout compares equal to the expected layout, which causes read_struct() to skip size validation; combined with deliberately short data blocks, subsequent field reads, writes and pointer dereferences overrun the heap. Limiting factors: the vector is local (AV:L) and needs user interaction (UI:P) - the attacker cannot trigger it remotely or without the victim loading the file - and no authentication or special non-default configuration is required beyond using an unpatched version.

This is a genuine priority within its context but not an internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) describes a local, file-opening attack: there is no network vector and exploitation requires the victim to open a crafted .blend file (UI:P), which caps real-world urgency relative to a remote-unauthenticated flaw. Against that, the technical impact is high across confidentiality, integrity and availability because a heap out-of-bounds access in read_struct() enables field reads, writes and pointer dereferences past heap bounds - consistent with the RCE and Information Disclosure tags. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV and no public exploit was identified, so there is no confirmed active exploitation. The vuln.today decision label is 'this_week', and a vendor patch is available, which together point to prompt-but-scheduled remediation rather than an out-of-band emergency. Note the vector is AV:L with UI:P (passive interaction such as opening/importing a file) rather than a network vector - defenders should treat this as a client-side file-parsing risk, not a server exposure.

An attacker distributes a malicious .blend file - for example via a shared asset pack, marketplace download, or project handoff - crafted with short data blocks whose SDNA struct layout compares equal so size validation is skipped. When a user opens or imports the file in a vulnerable Blender build, read_struct() reads, writes and dereferences past the allocated heap buffer, causing a crash or potentially arbitrary code execution in the user's context. No public exploit was identified at time of analysis, so this reflects the mechanism described in the advisory rather than a confirmed working exploit.