Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()

Summary

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

Remediation

1. Inventory every Blender Foundation Blender deployment, including staging.
2. Upgrade Blender Foundation Blender to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e
• Patchhttps://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5
• Patchhttps://projects.blender.org/blender/blender/pulls/164279
• Advisoryhttps://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct
• Referencehttps://projects.blender.org/blender/blender