Description
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Blender Foundation Blender
Default version status: unaffected
0 to < 4.5.15affected5.0.0 to < 5.2.3affected
References
- https://projects.blender.org/blender/blender/pulls/164279 ↗
- https://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5 ↗
- https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e ↗
- https://projects.blender.org/blender/blender ↗
- https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct ↗