RCE in Blender

CVE-2009-3850

Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.094 (94.9th percentile) — read the EPSS interpretation.

Affected products

Blender — versions 2.34, 2.35a, 2.40
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Exploit, x_refsource_MISC)