Blender Foundation has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The most common weakness class is CWE-125 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-119722High· 7.8Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()43CVE-2026-119719High· 7.8Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction43CVE-2026-119718High· 7.8Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache43CVE-2026-119721Medium· 6.1Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors34CVE-2026-119720Medium· 5.5Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block30
Blender Foundation vulnerabilities
CVEs affecting Blender Foundation, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-119719High· 7.8Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malici…
CVE-2026-119721Medium· 6.1Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID …
CVE-2026-119722High· 7.8Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file …
CVE-2026-119718High· 7.8Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totp…
CVE-2026-119720Medium· 5.5Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a trunca…