Executive brief
Blender, a popular open-source 3D creation suite, is vulnerable to a memory handling error when processing specially crafted files. An attacker could share a malicious .blend file that, when opened by a user, causes the application to crash or potentially exposes sensitive information from the computer's memory. This issue affects versions 3.0.0 through 5.1.2 and can disrupt operations or lead to unauthorized data access.
Technical details
An out-of-bounds read vulnerability exists in Blender versions 3.0.0 through 5.1.2 within the SDNA block processing logic. The root cause is a lack of bounds validation for the 'member_index' field, a signed short used as an array index into the 'sdna->members[]' array in the 'sdna_expand_names()' function. By supplying a crafted .blend file with a malicious index, an attacker can force the application to generate an invalid pointer. This pointer is subsequently passed to 'strlen()', leading to a SIGSEGV crash or the disclosure of unintended heap memory. Exploitation requires a user to open a malicious file (User Interaction). A fix has been merged into the main Blender repository.
Affected products
- Blender Foundation Blender 3.0.0 through 5.1.2
Timeline
- 2026-07-09: disclosed: Initial pull request and code review started
- 2026-07-13: patched: Fix merged into main repository via commit 968972a918b5ed2d534295b639c54449d7de11cd
- 2026-07-13: advisory: NVD and VulnCheck published advisory details