Source: blender Version: 5.0.1+dfsg-3 Severity: important Tags: security upstream Forwarded: https://projects.blender.org/blender/blender/pulls/161273 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for blender. CVE-2026-60103[0]: | Blender 3.0.0 through 5.1.2 contains an out-of-bounds read | vulnerability that allows attackers to trigger a crash or read | adjacent heap memory by supplying a crafted .blend file with a | malicious signed short member_index value in the SDNA block. The | member_index field is used as an array index into the | sdna->members[] array in sdna_expand_names() without bounds | validation, allowing any value outside the allocated range to | produce an invalid pointer subsequently passed to strlen(), | resulting in a SIGSEGV crash or unintended heap memory disclosure. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-60103 https://www.cve.org/CVERecord?id=CVE-2026-60103 [1] https://projects.blender.org/blender/blender/pulls/161273 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
