CVE-2026-119719: 
Blender Analyse et atténuation de la vulnérabilité

CVE-2026-119719 is a heap buffer overflow vulnerability in Blender's blend file thumbnail extractor, caused by a 32-bit integer overflow in the thumb_data_vertical_flip() function. It affects Blender versions before 4.5.15 and 5.x versions before 5.2.3, developed by the Blender Foundation. The vulnerability was disclosed on October 30, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a 32-bit integer overflow (CWE-190) in the thumb_data_vertical_flip() function within Blender's thumbnail extraction component, which subsequently leads to an out-of-bounds write (CWE-787) on the heap. An attacker crafts a .blend file with malicious TEST block dimensions; when the file is previewed by blender-thumbnailer or the Windows shell extension, the integer overflow causes an undersized buffer allocation, and the subsequent write operation exceeds the buffer boundary. Exploitation requires no privileges but does require passive user interaction — specifically, a victim browsing to or previewing the malicious file in a file manager or Windows Explorer. Patch commits are publicly available in the Blender project repository (GitHub Advisory, Blender Commits).

Successful exploitation can result in arbitrary code execution in the context of the user whose file manager or shell extension triggered the thumbnail preview, with high impact to confidentiality, integrity, and availability of the affected system. At minimum, the vulnerability causes application crashes (denial of service). Because thumbnail generation can be triggered automatically by the OS without explicit user action beyond navigating to a directory containing the malicious file, the attack surface is broad for desktop users on both Linux and Windows platforms (GitHub Advisory, Red Hat CVE).

As of the disclosure date (October 30, 2026), there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. No threat actor attribution has been reported. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Craft malicious .blend file: Create a .blend file with a specially crafted TEST block where the width and/or height dimensions are set to values that, when processed by thumb_data_vertical_flip(), cause a 32-bit integer overflow during buffer size calculation.
2. Trigger undersized allocation: The overflowed dimension value causes the thumbnail extractor to allocate a heap buffer smaller than the actual data to be written.
3. Deliver the file to the target: Distribute the malicious .blend file via email attachment, file sharing platform, social engineering, or by placing it in a shared network directory accessible to the target.
4. Trigger automatic preview: The victim navigates to the directory containing the file in a file manager (Linux) or Windows Explorer, causing blender-thumbnailer or the Windows shell extension to automatically generate a thumbnail preview without the user explicitly opening the file.
5. Out-of-bounds write occurs: The thumbnail extractor writes image data beyond the allocated heap buffer, corrupting adjacent heap memory.
6. Achieve code execution or crash: With sufficient heap layout control, an attacker can redirect execution flow to attacker-controlled code; alternatively, the overflow causes a crash (GitHub Advisory).

• File System: Presence of unexpected or unsolicited .blend files in user directories, downloads, or shared network folders; files with anomalously large or malformed TEST block headers detectable via hex inspection.
• Process: Unexpected child processes spawned by blender-thumbnailer or Windows Explorer shell extension processes (e.g., cmd.exe, powershell.exe, bash, curl, wget); crashes or core dumps from blender-thumbnailer.
• Logs: Application crash logs or core dumps referencing thumb_data_vertical_flip() or heap corruption errors in Blender-related processes; Windows Event Log entries showing Explorer.exe or shell extension crashes when browsing specific directories.
• Network: Outbound connections from blender-thumbnailer or explorer.exe to unexpected external IP addresses following file preview events.

Update Blender to version 4.5.15 or later (for the 4.x branch) or 5.2.3 or later (for the 5.x branch), which contain the fix applied in commits d723c68112d216099c9b24dab5c8440bab7add08 and 71c10a0217d5e331b215b76773ad23b64974bd97. As a workaround prior to patching, disable thumbnail previews for .blend files in your file manager and Windows Explorer shell settings, and avoid browsing directories containing untrusted .blend files. Exercise caution when receiving .blend files from untrusted sources (GitHub Advisory, Red Hat CVE).