Blender versions before 4.5.15 and before 5.2.3 contain an out-of-bounds read flaw in the blo_bhead_id_* accessors in readfile.cc. The implementation reads ID fields of block headers without ensuring the block payload length is sufficient. An attacker can supply a crafted .blend file with short ID blocks that, when processed by the program—such as during file browsing, opening or appending—triggers a heap over-read. The read may result in a crash or the disclosure of heap memory contents, potentially leaking internal data.

The affected product is Blender, released by the Blender Foundation. All releases prior to 4.5.15 and all 5.x releases before 5.2.3 are vulnerable regardless of operating system, including Windows, macOS, and Linux. No specific sub-components are listed beyond the mentioned readfile.cc functions.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a crafted .blend file that is opened or otherwise processed by Blender. While the flaw does not provide a straightforward remote code execution path, it can lead to denial of service or memory disclosure, affecting confidentiality, integrity, or availability of any user or system that processes the malicious file.