CVE-2026-119719
Description
A flaw was found in Blender. This vulnerability may allow arbitrary code execution or cause an application crash resulting in a Denial of Service (DoS). By convincing a user to preview a specially crafted blend file with invalid image dimensions, an attacker can trigger an integer overflow in the thumbnail extractor. This condition leads to an out-of-bounds memory write, potentially enabling unauthorized code execution in the context of the user.
Statement
This vulnerability is rated as Important severity because successful exploitation allows arbitrary code execution or process termination under the privileges of the executing user, despite requiring user interaction. The flaw is triggered when thumbnail preview handlers process malformed project files, potentially enabling an attacker to compromise local user sessions. Blender is not shipped or supported in core Red Hat Enterprise Linux and is only distributed through community repositories like EPEL, which limits enterprise attack surface.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate TEST block image dimensions and bounds before arithmetic operations in thumb_data_vertical_flip() during thumbnail extraction: upgrade to blender 4.5.15, 5.2.3+ (or the fixed Blender builds), which validates TEST block image dimensions and size parameters prior to processing in thumb_data_vertical_flip() to prevent integer overflow and heap buffer corruption, closing all 2 injection vectors (file preview via blender-thumbnailer, file preview via Windows shell extension). Until patched, this is a concern on systems and user sessions previewing or handling .blend files with Blender thumbnail extractors enabled, so disable thumbnail generation for .blend files in file managers and Windows Explorer, and avoid previewing or opening untrusted .blend files. As a compensating measure, randomize process memory layout using ASLR to obstruct reliable execution of ROP chains or shellcode following heap buffer overflow, compile binaries with Full RELRO and PIE to prevent Global Offset Table overwrites via heap corruption, enforce forward-edge control flow integrity to block hijacked indirect calls resulting from corrupted heap pointers, enforce Arbitrary Code Guard on Windows to block dynamic allocation of executable pages during shell extension thumbnail extraction, and enforce NX/XD non-executable page protections to prevent execution of payloads placed in heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
