Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119718Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache
High 7.8
In plain English
A high-severity integer overflow in Blender from Blender Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 91.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | blender | no fix listed | DEBIAN-CVE-2026-119718 |
| Debian:13 | blender | no fix listed | DEBIAN-CVE-2026-119718 |
| Ubuntu:22.04:LTS | blender | no fix listed | UBUNTU-CVE-2026-119718 |
| Ubuntu:24.04:LTS | blender | no fix listed | UBUNTU-CVE-2026-119718 |
| Ubuntu:26.04:LTS | blender | no fix listed | UBUNTU-CVE-2026-119718 |
| Ubuntu:26.10 | blender | no fix listed | UBUNTU-CVE-2026-119718 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Blender Foundation | Blender | 0 – before 4.5.155.0.0 – before 5.2.3 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://projects.blender.org/blender/blender/pulls/164279 patch
- https://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43 patch
- https://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47 patch
- https://projects.blender.org/blender/blender product
- VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache third-party-advisory