# CVE-2026-119722: Blender heap out-of-bounds access in SDNA struct parsing

Source: https://junglewise.ai/threats/cve-2026-119722-blender-before-4-5-15-and-5-x-before-5-2-3-contains-a-heap-out  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119722 · Severity: high · CVSS 7.8 · Published 2026-10-30

Blender, a widely-used 3D modeling and animation software, contains a memory safety vulnerability in how it parses .blend project files. An attacker can craft a malicious .blend file that causes Blender to read or write beyond allocated memory, leading to application crashes or potentially allowing code execution on a user's system.

Technologies: [Blender Foundation Blender](https://junglewise.ai/threats/technologies/blender). Vendors: [Blender Foundation](https://junglewise.ai/threats/vendors/blender-foundation).

## Quick answers

**Is CVE-2026-119722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119722 being exploited in the wild.

**How severe is CVE-2026-119722?** High severity, with a CVSS score of 7.8, published 30 October 2026.

**Which products and versions are affected?** Blender Foundation Blender before 4.5.15 and 5.0 before 5.2.3.

**Is there a fix for CVE-2026-119722?** Yes: fixed in Blender 4.5.15, 5.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119722 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-119722?** Check whether you run Blender Foundation Blender at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Blender 4.5.15, 5.2.3

## Technical details

The vulnerability exists in the read_struct() function which fails to validate the size of data blocks when the SDNA struct layout matches between the file and runtime. An attacker can craft a .blend file with intentionally short data blocks that cause field reads, writes, and pointer dereferences to overrun heap memory boundaries. This out-of-bounds access can result in denial of service or arbitrary code execution depending on heap layout and attacker capabilities.

## Affected products

- Blender Foundation Blender before 4.5.15 and 5.0 before 5.2.3

## Timeline

- 2026-10-30: disclosed
- 2026-10-30: advisory

## References

- [https://projects.blender.org/blender/blender](https://projects.blender.org/blender/blender)
- [https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e](https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e)

## Related threats

- [Blender heap buffer overflow in thumbnail extractor](https://junglewise.ai/threats/cve-2026-119719-blender-before-4-5-15-and-5-x-before-5-2-3-contains-a-heap)
- [Blender heap buffer overflow in ptcache_data_alloc](https://junglewise.ai/threats/cve-2026-119718-blender-before-4-5-15-and-5-x-before-5-2-3-contains-a-heap)
- [Blender out-of-bounds read in SDNA block processing](https://junglewise.ai/threats/cve-2026-60103-blender-out-of-bounds-read-in-sdna-block-processing)