Hi,

The following vulnerability was published for blender.

CVE-2026-60103[0]:
| Blender 3.0.0 through 5.1.2 contains an out-of-bounds read
| vulnerability that allows attackers to trigger a crash or read
| adjacent heap memory by supplying a crafted .blend file with a
| malicious signed short member_index value in the SDNA block. The
| member_index field is used as an array index into the
| sdna->members[] array in sdna_expand_names() without bounds
| validation, allowing any value outside the allocated range to
| produce an invalid pointer subsequently passed to strlen(),
| resulting in a SIGSEGV crash or unintended heap memory disclosure.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-60103
https://www.cve.org/CVERecord?id=CVE-2026-60103
[1] https://projects.blender.org/blender/blender/pulls/161273

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore