CVE-2026-119718: 
Blender Analyse et atténuation de la vulnérabilité

CVE-2026-119718 is a heap buffer overflow vulnerability in Blender caused by an integer overflow in the ptcache_data_alloc() function when reading point cache files. It affects Blender versions before 4.5.15 and 5.x versions before 5.2.3, developed by the Blender Foundation. The vulnerability was published on October 30, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an integer overflow (CWE-190) in the ptcache_data_alloc() function, which leads to an out-of-bounds write (CWE-787) on the heap when Blender processes a point cache file. An attacker crafts a .ptcache file with an excessively large totpoint value; when this value is used in a size calculation, the integer overflows and causes a smaller-than-expected heap buffer to be allocated, which is subsequently written beyond its bounds. Exploitation requires the victim to open the malicious .ptcache file alongside a .blend file, making user interaction a prerequisite. Relevant fix commits are available in the Blender project repository (GitHub Advisory, Blender Commits).

Successful exploitation can result in a crash of the Blender application (denial of availability) or arbitrary code execution with the privileges of the user running Blender, yielding high confidentiality, integrity, and availability impact on the affected system. Because Blender runs as a desktop application, the scope is limited to the local user context; however, code execution could enable an attacker to access sensitive files, install malware, or pivot further within the user's environment. The vulnerability does not affect subsequent/networked systems directly, but local code execution provides a meaningful foothold for further attack (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Red Hat CVE). The EPSS score is 0.0, reflecting a very low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack is not automatable — it requires a user to open a specially crafted file — which limits mass exploitation potential. No threat actor attribution has been reported (GitHub Advisory).

1. Craft malicious point cache file: Create a .ptcache file with an oversized totpoint value designed to trigger an integer overflow in ptcache_data_alloc() when parsed by Blender.
2. Bundle with a .blend file: Package the malicious .ptcache file alongside a legitimate-looking .blend project file, as Blender reads point cache files in the context of a blend project.
3. Deliver to target: Distribute the crafted files via email attachment, file-sharing platform, online asset marketplace, or social engineering (e.g., posing as a Blender project or asset pack).
4. Victim opens the file: When the target user opens the .blend file in a vulnerable version of Blender (before 4.5.15 or 5.x before 5.2.3), Blender automatically loads the associated .ptcache file.
5. Trigger overflow and heap corruption: The integer overflow in ptcache_data_alloc() causes an undersized heap buffer allocation; subsequent writes overflow the buffer, corrupting heap memory.
6. Achieve code execution or crash: Depending on heap layout and attacker control over overflow data, the result is either a crash (denial of service) or arbitrary code execution as the user running Blender (GitHub Advisory).

• File System: Unexpected .ptcache files in Blender project directories, especially those with unusually large file sizes or anomalous totpoint metadata values; presence of unknown executables or scripts created in user-writable directories after opening a Blender project.
• Process: Blender process crashing unexpectedly (segmentation fault or access violation) shortly after opening a .blend file; unusual child processes spawned by the Blender process (e.g., cmd.exe, powershell.exe, bash, curl, wget).
• Logs: Application crash logs or core dumps referencing ptcache_data_alloc in the stack trace; OS-level crash reports (Windows Error Reporting, macOS crash reporter, Linux dmesg) showing heap corruption in the Blender process.

Users should upgrade Blender to version 4.5.15 or later (for the 4.x branch) or 5.2.3 or later (for the 5.x branch), where the integer overflow in ptcache_data_alloc() has been patched (GitHub Advisory, Blender PR). As a workaround, users should avoid opening .ptcache files or .blend projects received from untrusted or unknown sources. Organizations can consider sandboxing Blender when processing externally sourced files, or implementing file-type inspection policies to flag anomalous point cache files before they reach end users.

The vulnerability was noted on Mastodon by The Hacker Wire shortly after disclosure, indicating some community awareness. Red Hat tracked the issue via their CVE advisory system, and VulnCheck was credited as the assigner. No major vendor statements, detailed researcher write-ups, or significant media coverage beyond initial disclosure aggregators have been identified at this time (Red Hat CVE).