PT-2022-4824 · Blender+3 · Blender+3

Albin Eldstål-Ahrens · Published 2022-01-05 · Updated 2026-04-16 · CVE-2022-0544

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blender versions prior to 2.83.19 Blender versions prior to 2.93.8 Blender versions prior to 3.1

Description An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file.

Recommendations For versions prior to 2.83.19, update to version 2.83.19 or later. For versions prior to 2.93.8, update to version 2.93.8 or later. For versions prior to 3.1, update to version 3.1 or later.

Exploit

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALT-PU-2022-1579

ALT-PU-2022-2239

BDU:2022-05850

CVE-2022-0544

DLA-3060-1

DSA-5176-1

OPENSUSE-SU-2024:11859-1

OPENSUSE-SU-2025:15755-1

OPENSUSE-SU-2025:15756-1

OPENSUSE-SU-2026:10560-1

Affected Products

Alt Linux

Astra Linux

Blender

Red Os

References · 33

• 🔥 https://developer.blender.org/T94661 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0544 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10560-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3060-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0544 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-0544 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11859-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5176 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5176-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0544 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0544 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory