SZB-1e23c12ef7
Blender discloses CVE-2026-119718, a heap buffer overflow in point cache file parsing
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Blender
- Product
- Blender
- First seen
Summary
The Hacker Wire's advisory, as relayed on Mastodon, describes a heap buffer overflow in Blender before 4.5.15 and 5.x before 5.2.3, scored High (7.8). The item says an attacker could supply a crafted point cache file with a large totpoint value.
If you use Blender
Update Blender to 4.5.15 or later, or 5.2.3 or later
Avoid opening point cache files from untrusted sources until patched
Check the official Blender release notes to confirm the fixed versions
What the sources say 1
· Mastodon: “Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files.” Source