CVE-2026-119721: 
Blender Analyse et atténuation de la vulnérabilité

CVE-2026-119721 is an out-of-bounds read vulnerability in Blender's file parsing code (blo_bhead_id_* accessors in readfile.cc) that reads ID fields without validating block length. Affected versions include Blender before 4.5.15 and Blender 5.x before 5.2.3, developed by the Blender Foundation. The vulnerability was disclosed on October 30, 2026, and patches are available. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-125 (Out-of-bounds Read): the blo_bhead_id_* accessor functions in readfile.cc read ID fields from .blend file blocks without first verifying that the block is long enough to contain those fields. An attacker can craft a .blend file with artificially short ID blocks; when Blender parses such a file during a browse or append operation, it reads beyond the allocated heap buffer boundary. This corresponds to CAPEC-540 (Overread Buffers). The fix was applied across multiple commits to the Blender project repository (GitHub Advisory, Blender Commits).

Successful exploitation can cause Blender to crash (high availability impact) or disclose heap memory contents to the attacker (low confidentiality impact). Because the attack vector is local and requires user interaction — specifically, a user opening or appending a malicious .blend file — the scope is limited to the affected workstation and the Blender process's memory space. There is no integrity impact and no lateral movement potential inherent to this vulnerability, though heap memory disclosure could theoretically expose sensitive in-memory data such as file paths or project content (GitHub Advisory, Red Hat CVE).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation is not automatable and requires a victim to manually open or append a crafted .blend file, significantly limiting the attack surface (GitHub Advisory, Red Hat CVE).

1. Craft malicious .blend file: Create a .blend file with one or more ID blocks whose declared length is shorter than the actual ID field size expected by blo_bhead_id_* accessors in readfile.cc, causing the parser to read beyond the allocated buffer.
2. Deliver the file: Distribute the crafted .blend file to a target user via email, file-sharing platform, collaborative project repository, or any other social engineering vector.
3. Trigger parsing: Induce the victim to open the file directly in Blender or use Blender's "Append" or "Link" feature to browse the malicious file, which invokes the vulnerable ID accessor code.
4. Achieve objective: The heap over-read either crashes Blender (denial of service) or, under favorable memory layout conditions, causes heap memory contents to be surfaced — potentially disclosable through error messages, log output, or side-channel observation (GitHub Advisory).

• File System: Unexpected or unsolicited .blend files received via email, messaging, or shared drives, particularly from unknown sources.
• Process: Blender process terminating abnormally (crash/segfault) immediately after opening or appending a .blend file.
• Logs: Operating system crash reports or core dumps associated with the Blender process (blender, blender.exe) referencing memory access violations or heap corruption in readfile.cc.
• Application Logs: Blender crash handler output referencing blo_bhead_id_* functions or out-of-bounds memory access in the file reading subsystem.

Users should update Blender to version 4.5.15 or later (for the 4.x branch) or to version 5.2.3 or later (for the 5.x branch), as patches have been released and are available from the Blender project. As a workaround prior to patching, users should avoid opening or appending .blend files received from untrusted or unknown sources. No configuration-based mitigation is available that fully addresses the vulnerability without upgrading (GitHub Advisory, Blender Commits).

The vulnerability was noted on the Infosec.exchange Mastodon instance shortly after disclosure, and standard CVE tracking feeds (NVD, CVEFeed, cve.report) picked it up on the day of publication. No significant vendor statements beyond the patch commits, notable researcher commentary, or major media coverage have been identified at this time (Red Hat CVE).