CVE-2026-119720: 
Blender Analyse et atténuation de la vulnérabilité

CVE-2026-119720 is a heap out-of-bounds read vulnerability in Blender's read_file_dna() function that allows an attacker to crash the application by supplying a crafted .blend file containing a truncated GLOB block whose declared length is not validated. It affects Blender before version 4.5.15 and Blender 5.x before version 5.2.3. The vulnerability was published on October 30, 2026, and is classified as CWE-125 (Out-of-bounds Read). It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds read (CWE-125) in Blender's file parsing code, specifically in the read_file_dna() function responsible for reading DNA (data structure definition) blocks from .blend files. When processing a GLOB block, the function reads a field using the block's declared length without first validating that the declared length is within the actual bounds of the data buffer. An attacker can craft a .blend file with a truncated GLOB block such that the declared length exceeds the available data, causing Blender to read heap memory beyond the allocated buffer. Exploitation requires user interaction — the victim must open the malicious file — and no elevated privileges are needed. Patches are referenced in Blender's project repository commits (GitHub Advisory, VulnCheck Advisory).

Successful exploitation results in a denial of service — Blender crashes when the out-of-bounds heap read is triggered. There is no impact on confidentiality or integrity; the vulnerability is limited to availability of the Blender application on the affected system. No lateral movement or data exfiltration potential has been identified, and the scope is confined to the vulnerable Blender process (GitHub Advisory, Red Hat CVE).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to convince a user to open a malicious .blend file, which limits the practical attack surface.

1. Craft a malicious .blend file: Create a .blend file with a GLOB block whose declared length field is set to a value larger than the actual data present in the block, resulting in a truncated buffer.
2. Deliver the file to the target: Distribute the crafted .blend file to a Blender user via email attachment, file-sharing platform, or a compromised asset repository, relying on social engineering to prompt the user to open it.
3. Trigger the vulnerability: When the victim opens the file in a vulnerable version of Blender (before 4.5.15 or 5.x before 5.2.3), read_file_dna() reads the GLOB block field using the attacker-controlled length without bounds checking.
4. Achieve denial of service: The out-of-bounds heap read causes Blender to crash, denying the user access to the application and any unsaved work (GitHub Advisory, VulnCheck Advisory).

• File System: Presence of unexpected or unsolicited .blend files received from external sources, particularly those with unusually small file sizes relative to their declared content.
• Process: Blender process terminating unexpectedly or generating crash dumps/core files immediately upon opening a .blend file.
• Logs: Operating system crash reports or application error logs referencing Blender with heap memory access violations or segmentation faults tied to file parsing operations.

Users should update Blender to version 4.5.15 or later (for the 4.x branch) or version 5.2.3 or later (for the 5.x branch), where the vulnerability has been patched (GitHub Advisory, VulnCheck Advisory). As a workaround prior to patching, users should exercise caution and avoid opening .blend files received from untrusted or unknown sources. Organizations can enforce file-origin policies and user awareness training to reduce the social engineering risk associated with this vulnerability.