Heap Buffer Overflow in Blender Point Cache Handling

Executive Summary

Blender versions before 4.5.15 and 5.x before 5.2.3 have a heap buffer overflow issue caused by an integer overflow in the ptcache_data_alloc() function. This happens when reading point cache files. Attackers can exploit this by providing a specially crafted point cache file with an excessively large totpoint value combined with a .blend file, leading to crashes or arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Blender versions before 4.5.15 and 5.x before 5.2.3. To detect it, check the installed Blender version using the command 'blender --version'. If the version is below the specified thresholds, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to crash Blender or execute malicious code on your system. Since it requires user interaction to open a crafted file, the risk is higher if you download or open untrusted .blend or point cache files. The impact includes potential data loss, system compromise, or unauthorized access depending on the attacker's goals.

Useful 0 Not Useful 0

Mitigation Strategies

Update Blender to version 4.5.15 or later, or 5.2.3 or later, depending on the branch you are using. Avoid opening untrusted .blend or point cache files until the update is applied.

Useful 0 Not Useful 0