CVE-2026-119718
Description
A flaw was found in Blender. An integer overflow issue in the point cache allocation function (ptcache_data_alloc()) leads to a heap-based buffer overflow when reading point cache data. An attacker could exploit this vulnerability by convincing a user to load a specially crafted point cache file alongside a project file, potentially leading to arbitrary code execution or a Denial of Service (DoS) crash.
Statement
This vulnerability is evaluated with an Important severity rating because successful exploitation allows arbitrary code execution within the privileges of the active user session. In Red Hat environments, Blender is not deployed as a standard core service, and exposure is primarily confined to graphical workstations where the application is explicitly installed. The vulnerability requires user interaction to open an untrusted project file along with malicious point cache data, preventing automated or unauthenticated remote attacks.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to trap signed integer arithmetic overflow during buffer size calculation in ptcache_data_alloc() to abort execution before an undersized heap allocation occurs: upgrade to blender 4.5.15, 5.2.3 (or the fixed Blender builds), which validate calculation bounds in ptcache_data_alloc() to prevent integer overflow when reading point cache files with large totpoint values, closing all 2 injection vectors (crafted point cache file, untrusted .blend project file). Until patched, this is a concern on workstations and systems running Blender where users load untrusted project and point cache files, so prevent users from opening untrusted .blend project files and point cache files from unverified sources. As a compensating measure, enable Address Space Layout Randomization to randomize Blender userspace memory layout, enforce full RELRO and PIE to protect the Global Offset Table and randomize binary code addresses, apply Control Flow Integrity to restrict indirect call and jump targets, validate totpoint values against upper bounds before memory allocation, deploy EDR agents to monitor anomalous process behavior spawned from Blender sessions, and enforce non-executable memory permissions on heap pages via NX/XD bit. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow heap-buffer-overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
