PT-2022-4819 · Blender+2 · Blender+2

Albin Eldstål-Ahrens · Published 2022-01-02 · Updated 2026-04-16 · CVE-2022-0546

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blender versions 2.93.8 through 3.x

Description The issue is related to a missing bounds check in the image loader, leading to out-of-bounds heap access. This allows an attacker to cause denial of service, memory corruption, or potentially code execution. The attacker can exploit this issue remotely to access confidential data, compromise its integrity, and cause service disruption.

Recommendations For Blender versions 2.93.8 through 3.x, update to a version that includes the fix for the missing bounds check in the image loader. As a temporary workaround, consider restricting the use of the image loader in Blender until a patch is available.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-05845

CVE-2022-0546

DLA-3060-1

DSA-5176-1

OPENSUSE-SU-2024:11859-1

OPENSUSE-SU-2025:15755-1

OPENSUSE-SU-2025:15756-1

OPENSUSE-SU-2026:10560-1

Affected Products

Astra Linux

Blender

Red Os

References · 34

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11859-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0546 · Security Note
• https://ubuntu.com/security/CVE-2022-0546 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15755-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0546 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10560-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5176-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://developer.blender.org/T94572 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0546 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0546 · Security Note