Heap Out-of-Bounds Read in Blender

Executive Summary

This is a heap out-of-bounds read vulnerability in Blender versions before 4.5.15 and 5.x before 5.2.3. It occurs in the read_file_dna() function when processing a GLOB block field in a .blend file. The vulnerability arises because the function reads the field without checking its declared length, allowing attackers to craft a malicious .blend file with a truncated GLOB block. Opening such a file triggers an out-of-bounds read, causing Blender to crash.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the installed version of Blender. Run 'blender --version' to see if your version is below 4.5.15 or 5.x below 5.2.3. Inspect any .blend files from untrusted sources for unexpected crashes when opened.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing Blender to crash when opening a specially crafted .blend file. While it does not allow arbitrary code execution, the crash could lead to loss of unsaved work or disruption of workflows. The impact is limited to local attacks, as the attacker must supply the malicious file directly.

Useful 0 Not Useful 0

Mitigation Strategies

Update Blender to version 4.5.15 or later, or 5.2.3 or later if using the 5.x branch. Avoid opening .blend files from untrusted sources until patched. Monitor for crashes when processing .blend files as a potential indicator of exploitation.

Useful 0 Not Useful 0