Is CVE-2026-60103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60103 being exploited in the wild.

How severe is CVE-2026-60103?

Medium severity, with a CVSS score of 6.1, published 13 July 2026.

Which products and versions are affected?

Blender Foundation Blender 3.0.0 through 5.1.2.

Is there a fix for CVE-2026-60103?

A patch was published on 2026-07-13: Fix merged into main repository via commit 968972a918b5ed2d534295b639c54449d7de11cd Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-60103 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-60103?

Check whether you run Blender Foundation Blender at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60103: Blender out-of-bounds read in SDNA block processing

CVE-2026-60103 · Severity: medium · CVSS 6.1 · Published 2026-07-13

Blender, a popular open-source 3D creation suite, is vulnerable to a memory handling error when processing specially crafted files. An attacker could share a malicious .blend file that, when opened by a user, causes the application to crash or potentially exposes sensitive information from the computer's memory. This issue affects versions 3.0.0 through 5.1.2 and can disrupt operations or lead to unauthorized data access.

Technologies: Blender Foundation Blender. Vendors: Blender Foundation.

Quick answers

Is CVE-2026-60103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60103 being exploited in the wild.
How severe is CVE-2026-60103?: Medium severity, with a CVSS score of 6.1, published 13 July 2026.
Which products and versions are affected?: Blender Foundation Blender 3.0.0 through 5.1.2.
Is there a fix for CVE-2026-60103?: A patch was published on 2026-07-13: Fix merged into main repository via commit 968972a918b5ed2d534295b639c54449d7de11cd Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-60103 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-60103?: Check whether you run Blender Foundation Blender at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in Blender versions 3.0.0 through 5.1.2 within the SDNA block processing logic. The root cause is a lack of bounds validation for the 'member_index' field, a signed short used as an array index into the 'sdna->members[]' array in the 'sdna_expand_names()' function. By supplying a crafted .blend file with a malicious index, an attacker can force the application to generate an invalid pointer. This pointer is subsequently passed to 'strlen()', leading to a SIGSEGV crash or the disclosure of unintended heap memory. Exploitation requires a user to open a malicious file (User Interaction). A fix has been merged into the main Blender repository.

Affected products

Blender Foundation Blender 3.0.0 through 5.1.2

Timeline

2026-07-09: disclosed: Initial pull request and code review started
2026-07-13: patched: Fix merged into main repository via commit 968972a918b5ed2d534295b639c54449d7de11cd
2026-07-13: advisory: NVD and VulnCheck published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.