Unscored severity · published Nov 6, 2009
CVE-2009-3850
Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA
–
CVSS
10%
EPSS
No
On KEV
Description
Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.0% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blender · Blender
2.34; 2.35a; 2.40; 2.49b · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3850
Exploit
http://www.coresecurity.com/content/blender-scripting-injection
www.securityfocus.com
http://www.securityfocus.com/archive/1/507706/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/36838
More from Blender
7.8
CVE-2022-0546
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or…
7.8
CVE-2022-0545
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive…
7.8
CVE-2017-2918
An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c
7.8
CVE-2017-2908
An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c
7.8
CVE-2017-2907
An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c