CVE-2026-60103

Name	CVE-2026-60103
Description	Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1143049

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
blender (PTS)	bullseye (security), bullseye	2.83.5+dfsg-5+deb11u1	vulnerable
	bookworm	3.4.1+dfsg-2	vulnerable
	trixie	4.3.2+dfsg-2	vulnerable
	forky, sid	5.0.1+dfsg-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
blender	source	(unstable)	(unfixed)	unimportant		1143049

Notes

https://projects.blender.org/blender/blender/pulls/161273
Fixed by: https://projects.blender.org/blender/blender/commit/968972a918b5ed2d534295b639c54449d7de11cd
Crash in CLI tool, no security impact