Blender
Monthly
Heap out-of-bounds memory access in Blender's .blend file parsing path (read_struct()) can crash Blender or potentially enable code execution when a victim opens a crafted file whose SDNA struct layout compares equal to the expected layout, causing the parser to skip size validation and process deliberately short data blocks. Blender before 4.5.15 and 5.x before 5.2.3 are affected; exploitation is local and requires user interaction to load the file, no public exploit identified at time of analysis, and vendor patches are available. The issue is a this-week priority within its local, file-opening context rather than an internet-facing emergency.
Heap-based buffer overflow in Blender's .blend thumbnail extractor (blender-thumbnailer and the Windows shell extension) allows memory corruption and potential code execution or crash when a crafted .blend file is previewed. The flaw is a 32-bit integer overflow in thumb_data_vertical_flip() that is driven by malicious TEST block dimensions in the file, producing an out-of-bounds write. Affected builds are Blender before 4.5.15 and 5.x before 5.2.3, with fixes released in 4.5.15 and 5.2.3; exploitation is local with passive user interaction (file preview) and no public exploit has been identified at time of analysis.
A heap buffer overflow in Blender's point cache loading path, driven by an integer overflow in ptcache_data_alloc(), affects all versions before 4.5.15 and 5.x releases before 5.2.3. An attacker who supplies a crafted point cache file with an abnormally large totpoint value alongside a .blend file can crash the application or execute code with the privileges of the user who opens it; the attack is local (AV:L) and requires the victim to open the attacker-supplied files (UI:P), with no authentication needed once the files are loaded. No public exploit code or active exploitation has been identified at time of analysis, and Blender has published fixes for both affected branches.
Out-of-bounds heap reads in Blender's .blend file loader let a crafted file crash the application or leak process memory, affecting releases before 4.5.15 and 5.x before 5.2.3. The weakness sits in the blo_bhead_id_* accessors in readfile.cc, which consume ID block fields without first checking that the block is long enough; a .blend file containing deliberately short ID blocks triggers the over-read when a victim browses or appends data from it. No authentication or elevated privileges are required (PR:N), but exploitation is local and file-based (AV:L) and requires the user to open or append from a malicious asset (UI:P), so realistic exposure is social engineering or supply-chain distribution of .blend content rather than remote attack; no public exploit code or KEV listing was identified at time of analysis, and this is a moderate-priority issue rather than an emergency, with vendor patches available.
Opening a crafted .blend file in a vulnerable Blender build causes a heap out-of-bounds read inside read_file_dna() and crashes the application. Blender releases before 4.5.15 and 5.x releases before 5.2.3 are affected; the attacker must get a victim to open a .blend file whose GLOB block is truncated with an unvalidated declared length. The assessed impact is availability only - an application crash with no demonstrated code execution, privilege gain, or data disclosure - so this is a medium-severity issue rather than an emergency; no public exploit was identified at time of analysis.
Out-of-bounds read in Blender 3.0.0 through 5.1.2 allows an attacker to crash the application or disclose heap memory contents by convincing a user to open a specially crafted .blend file containing a malicious member_index value in the SDNA block. The vulnerability stems from missing bounds validation on a signed short index used directly as an array subscript in sdna_expand_names(), enabling both denial-of-service via SIGSEGV and limited heap memory disclosure. No public exploit code or active exploitation has been identified at time of analysis, but the file-based attack vector makes social engineering a realistic delivery mechanism.
Endless Infinite loop in Blender-thumnailing due to logical bugs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Blender 3.3.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Blender 3.3.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap out-of-bounds memory access in Blender's .blend file parsing path (read_struct()) can crash Blender or potentially enable code execution when a victim opens a crafted file whose SDNA struct layout compares equal to the expected layout, causing the parser to skip size validation and process deliberately short data blocks. Blender before 4.5.15 and 5.x before 5.2.3 are affected; exploitation is local and requires user interaction to load the file, no public exploit identified at time of analysis, and vendor patches are available. The issue is a this-week priority within its local, file-opening context rather than an internet-facing emergency.
Heap-based buffer overflow in Blender's .blend thumbnail extractor (blender-thumbnailer and the Windows shell extension) allows memory corruption and potential code execution or crash when a crafted .blend file is previewed. The flaw is a 32-bit integer overflow in thumb_data_vertical_flip() that is driven by malicious TEST block dimensions in the file, producing an out-of-bounds write. Affected builds are Blender before 4.5.15 and 5.x before 5.2.3, with fixes released in 4.5.15 and 5.2.3; exploitation is local with passive user interaction (file preview) and no public exploit has been identified at time of analysis.
A heap buffer overflow in Blender's point cache loading path, driven by an integer overflow in ptcache_data_alloc(), affects all versions before 4.5.15 and 5.x releases before 5.2.3. An attacker who supplies a crafted point cache file with an abnormally large totpoint value alongside a .blend file can crash the application or execute code with the privileges of the user who opens it; the attack is local (AV:L) and requires the victim to open the attacker-supplied files (UI:P), with no authentication needed once the files are loaded. No public exploit code or active exploitation has been identified at time of analysis, and Blender has published fixes for both affected branches.
Out-of-bounds heap reads in Blender's .blend file loader let a crafted file crash the application or leak process memory, affecting releases before 4.5.15 and 5.x before 5.2.3. The weakness sits in the blo_bhead_id_* accessors in readfile.cc, which consume ID block fields without first checking that the block is long enough; a .blend file containing deliberately short ID blocks triggers the over-read when a victim browses or appends data from it. No authentication or elevated privileges are required (PR:N), but exploitation is local and file-based (AV:L) and requires the user to open or append from a malicious asset (UI:P), so realistic exposure is social engineering or supply-chain distribution of .blend content rather than remote attack; no public exploit code or KEV listing was identified at time of analysis, and this is a moderate-priority issue rather than an emergency, with vendor patches available.
Opening a crafted .blend file in a vulnerable Blender build causes a heap out-of-bounds read inside read_file_dna() and crashes the application. Blender releases before 4.5.15 and 5.x releases before 5.2.3 are affected; the attacker must get a victim to open a .blend file whose GLOB block is truncated with an unvalidated declared length. The assessed impact is availability only - an application crash with no demonstrated code execution, privilege gain, or data disclosure - so this is a medium-severity issue rather than an emergency; no public exploit was identified at time of analysis.
Out-of-bounds read in Blender 3.0.0 through 5.1.2 allows an attacker to crash the application or disclose heap memory contents by convincing a user to open a specially crafted .blend file containing a malicious member_index value in the SDNA block. The vulnerability stems from missing bounds validation on a signed short index used directly as an array subscript in sdna_expand_names(), enabling both denial-of-service via SIGSEGV and limited heap memory disclosure. No public exploit code or active exploitation has been identified at time of analysis, but the file-based attack vector makes social engineering a realistic delivery mechanism.
Endless Infinite loop in Blender-thumnailing due to logical bugs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Blender 3.3.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Blender 3.3.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.