CVE-2022-0546
Fixed in a distro release EPSS 1%
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.
Products: blender, fedoraproject extra_packages_for_enterprise_linux, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | blender | 17:3.1.0-1 |
| Debian 10 | blender | 2.79.b+dfsg0-7+deb10u1 |
| Debian 11 | blender | 2.83.5+dfsg-5+deb11u1 |
| Debian 12 | blender | 3.1.2+dfsg-1 |
| Debian 13 | blender | 3.1.2+dfsg-1 |
| Debian 9 | blender | 2.79.b+dfsg0-1~deb9u2 |
| Ubuntu 16.04 LTS | blender | no fix |
| Ubuntu 18.04 LTS | blender | no fix |
| Ubuntu 20.04 LTS | blender | no fix |
| Ubuntu 22.04 LTS | blender | no fix |
| Ubuntu 24.04 LTS | blender | no fix |
| Ubuntu 25.10 | blender | no fix |
| Ubuntu 26.04 LTS | blender | no fix |
| Ubuntu 26.10 | blender | no fix |
| openSUSE Tumbleweed | blender | 3.0.1-2.1 |
| openSUSE Tumbleweed | blender-4.5 | 4.5.4-1.1 |
| openSUSE Tumbleweed | blender-5.0 | 5.0.0-1.1 |
| openSUSE Tumbleweed | blender-5.1 | 5.1.1-1.1 |
| openSUSE Tumbleweed | blender-5.2 | 5.2.0-1.1 |