# CVE-2026-119719: Blender heap buffer overflow in thumbnail extractor

Source: https://junglewise.ai/threats/cve-2026-119719-blender-before-4-5-15-and-5-x-before-5-2-3-contains-a-heap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119719 · Severity: high · CVSS 7.8 · Published 2026-10-30

Blender, a 3D modeling and animation software, contains a heap buffer overflow in its thumbnail preview functionality. An attacker can craft a malicious .blend file that causes a crash or executes arbitrary code when the file is previewed by Blender's thumbnail tool or Windows shell extension, potentially compromising systems that routinely open or preview untrusted .blend files.

Technologies: [Blender Foundation Blender](https://junglewise.ai/threats/technologies/blender). Vendors: [Blender Foundation](https://junglewise.ai/threats/vendors/blender-foundation).

## Quick answers

**Is CVE-2026-119719 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119719 being exploited in the wild.

**How severe is CVE-2026-119719?** High severity, with a CVSS score of 7.8, published 30 October 2026.

**Which products and versions are affected?** Blender Foundation Blender before 4.5.15 and 5.x before 5.2.3.

**Is there a fix for CVE-2026-119719?** Yes: fixed in Blender 4.5.15, 5.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119719 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-119719?** Check whether you run Blender Foundation Blender at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Blender 4.5.15, 5.2.3

## Technical details

A 32-bit integer overflow in the thumb_data_vertical_flip() function within the blend file thumbnail extractor allows a heap buffer overflow when processing TEST block dimensions. The vulnerability is triggered via crafted .blend files with malicious dimensions, leading to out-of-bounds writes. An attacker needs a user to preview or open the malicious .blend file; remote code execution is possible.

## Affected products

- Blender Foundation Blender before 4.5.15 and 5.x before 5.2.3

## Timeline

- 2026-10-30: disclosed

## References

- [https://projects.blender.org/blender/blender](https://projects.blender.org/blender/blender)
- [https://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97](https://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97)

## Related threats

- [Blender heap out-of-bounds access in SDNA struct parsing](https://junglewise.ai/threats/cve-2026-119722-blender-before-4-5-15-and-5-x-before-5-2-3-contains-a-heap-out)
- [Blender heap buffer overflow in ptcache_data_alloc](https://junglewise.ai/threats/cve-2026-119718-blender-before-4-5-15-and-5-x-before-5-2-3-contains-a-heap)
- [Blender out-of-bounds read in SDNA block processing](https://junglewise.ai/threats/cve-2026-60103-blender-out-of-bounds-read-in-sdna-block-processing)