The flaw resides in Blender's blend file thumbnail extractor, where thumb_data_vertical_flip() experiences a 32‑bit integer overflow that leads to a heap buffer overflow. An attacker can craft a .blend file with malicious TEST block dimensions, causing an out‑of‑bounds write when blender‑thumbnailer or the Windows shell extension renders the thumbnail. The overflow can crash the process or potentially execute arbitrary code, compromising confidentiality, integrity, or availability of the affected system.

Blender releases prior to 4.5.15 and all 5.x versions before 5.2.3 on any operating system that uses the thumbnailer or Windows shell extension are affected. The issue occurs when a user opens a malicious .blend file or a file whose preview is rendered by the operating system.

The vulnerability carries a CVSS score of 8.5, indicating high severity. EPSS data is not available, so the exploitation probability is unknown, but the local file‑based nature of the attack makes it readily exploitable where untrusted files are processed. The issue is not listed in the CISA KEV catalog. An attacker who can supply a crafted .blend file— for example via email attachment, shared drive, or malicious thumbnail in a file explorer—can trigger the overflow.