Hi,

The following vulnerabilities were published for blender.

CVE-2026-119718[0]:
| Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer
| overflow vulnerability caused by integer overflow in
| ptcache_data_alloc() when reading point cache files. Attackers can
| supply a crafted point cache file with a large totpoint value
| alongside a .blend file to crash Blender or execute code as the
| user.


CVE-2026-119719[1]:
| Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer
| overflow vulnerability in the blend file thumbnail extractor caused
| by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers
| can craft a .blend file with malicious TEST block dimensions that
| trigger an out-of-bounds write when blender-thumbnailer or the
| Windows shell extension previews it, causing crashes or code
| execution.


CVE-2026-119720[2]:
| Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-
| bounds read vulnerability in read_file_dna() that reads a GLOB block
| field without validating its declared length. Attackers can supply a
| crafted .blend file with a truncated GLOB block that, when opened,
| triggers the out-of-bounds read and crashes Blender.


CVE-2026-119721[3]:
| Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds
| read vulnerability in blo_bhead_id_* accessors in readfile.cc that
| read ID fields without block length checks. Attackers can supply a
| crafted .blend file with short ID blocks that, when browsed or
| appended from, causes heap over-reads leading to crashes or heap
| memory disclosure.


CVE-2026-119722[4]:
| Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-
| bounds access vulnerability in read_struct() that skips size
| validation when a .blend file's SDNA struct layout compares equal.
| Attackers can supply a crafted .blend file with short blocks so
| field reads, writes, and pointer dereferences overrun heap memory,
| causing crashes or code execution.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-119718
https://www.cve.org/CVERecord?id=CVE-2026-119718
[1] https://security-tracker.debian.org/tracker/CVE-2026-119719
https://www.cve.org/CVERecord?id=CVE-2026-119719
[2] https://security-tracker.debian.org/tracker/CVE-2026-119720
https://www.cve.org/CVERecord?id=CVE-2026-119720
[3] https://security-tracker.debian.org/tracker/CVE-2026-119721
https://www.cve.org/CVERecord?id=CVE-2026-119721
[4] https://security-tracker.debian.org/tracker/CVE-2026-119722
https://www.cve.org/CVERecord?id=CVE-2026-119722

Regards,
Salvatore