Description
Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | blender | 2.40-1 | — |
| Debian 13 | blender | 2.40-1 | — |
| Debian 12 | blender | 2.40-1 | — |
| Debian 4.0 | blender | 2.37a-1.1etch1 | DTSA-29-1 |
| Debian 3.1 | blender | 2.36-1sarge1 | DSA-1039-1 |
Advisories 2
- DSA-1039-1 blender - several Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-29-1 blender - heap-based buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 18178 third-party-advisory
- 20051220 [Overflow.pl] Blender BlenLoader Integer Overflow mailing-list
- 19754 third-party-advisory
- DSA-1039 vendor-advisory
- ADV-2005-3032 vdb-entry
- http://www.overflow.pl/adv/blenderinteger.txt
- GLSA-200601-08 vendor-advisory
- 18176 third-party-advisory
- 15981 vdb-entry
- USN-238-2 vendor-advisory
- 18452 third-party-advisory