CVE-2026-119720: Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
Vulnerability summary
CVE-2026-119720 is a medium (CVSS 6.8) Out-of-bounds Read vulnerability in blender foundation blender. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.
Not severe (CVSS 6.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 30-10-2026PublishedVulnerability first disclosed.
Description
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
CVSS metrics
7 scores · 4 sources · 2 versions- NVDNIST6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Blender1 product
- blender< 4.5.15 | ≥ 5.0.0, < 5.2.3
Blender foundation1 product
- blender< 4.5.15 | ≥ 5.0.0, < 5.2.3
Debian1 product
- blenderAll versions (No fix recorded)
Ubuntu1 product
- blenderAll versions (No fix recorded)
4 vendors · 4 products
