CVE-2026-119722: 
Blender Analyse et atténuation de la vulnérabilité

CVE-2026-119722 is a heap out-of-bounds access vulnerability in Blender's read_struct() function that can lead to crashes or arbitrary code execution when a crafted .blend file is opened. The flaw affects Blender before version 4.5.15 and Blender 5.x before version 5.2.3, developed by the Blender Foundation. It was published on October 30, 2026, and is currently awaiting full NVD analysis. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is insufficient size validation in the read_struct() function during .blend file parsing (CWE-125: Out-of-bounds Read; CWE-787: Out-of-bounds Write). When a .blend file's SDNA (Structure DNA) struct layout compares equal to an expected layout, Blender skips size validation, allowing an attacker to supply a file with intentionally short data blocks. This causes field reads, writes, and pointer dereferences to overrun heap memory boundaries. Exploitation requires a local attacker to trick a user into opening a specially crafted .blend file — no elevated privileges are required (GitHub Advisory, Red Hat CVE). Relevant patches are available via the Blender project repository in pull request #164279 and associated commits.

Successful exploitation grants an attacker high impact across confidentiality, integrity, and availability of the vulnerable system. An attacker can read sensitive data from heap memory, modify in-memory data, or execute arbitrary code in the context of the user running Blender, potentially leading to full local system compromise. Application crashes (denial of service) are also a likely outcome. Because the attack is scoped to the local system without subsequent system impact, lateral movement potential is limited, though code execution could serve as a foothold for further privilege escalation (GitHub Advisory, Red Hat CVE).

As of the disclosure date (October 30, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable, requiring passive user interaction (opening a malicious file). The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious .blend file: Create a .blend file with a manipulated SDNA struct layout that matches an expected layout but contains intentionally short data blocks, causing read_struct() to skip size validation.
2. Social engineering delivery: Deliver the crafted .blend file to a target user via email attachment, file-sharing platform, or a compromised asset repository, disguising it as a legitimate Blender project file.
3. Trigger file open: Convince the target user to open the malicious .blend file in a vulnerable version of Blender (before 4.5.15 or 5.x before 5.2.3).
4. Heap memory overrun: Upon parsing, read_struct() performs field reads, writes, and pointer dereferences beyond the allocated heap buffer boundaries due to the missing size check.
5. Achieve code execution or crash: Depending on heap layout and attacker control over overrun data, the outcome ranges from a denial-of-service crash to arbitrary code execution in the context of the Blender process (GitHub Advisory).

• File System: Presence of unexpected or externally sourced .blend files in user directories; Blender crash dump files (e.g., core dumps on Linux, minidumps on Windows) generated shortly after opening a .blend file.
• Process: Blender process terminating abnormally or spawning unexpected child processes (e.g., shells, network utilities) following file open events.
• Logs: Application crash logs or OS-level fault reports referencing heap corruption or segmentation faults within Blender's read_struct() or related file parsing functions.
• Network: Unexpected outbound network connections originating from the Blender process after opening a .blend file, which may indicate post-exploitation activity if code execution is achieved.

Blender Foundation has released patched versions: 4.5.15 and 5.2.3. Users should update to these versions or later immediately. As a workaround until patching is possible, users should avoid opening .blend files from untrusted or unknown sources, and administrators should restrict file-opening permissions where feasible. Organizations using Blender in pipeline or collaborative environments should enforce file provenance controls (GitHub Advisory, Red Hat CVE).

The vulnerability was assigned and disclosed by VulnCheck and published to the GitHub Advisory Database and Red Hat CVE tracker on October 30, 2026. No notable researcher commentary, vendor statements beyond the patch release, or significant social media discussion has been identified at this time.