What’s Vulnerable › Vulnerabilities

CVE-2022-0546

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-24 · updated 2026-06-17
• Weakness: CWE-190

Description

A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.

Affected products

• Blender: 2.93.8, 3.0
• Debian Linux: 9.0, 10.0, 11.0
• Fedoraproject Extra Packages For Enterprise Linux: 7.0
• Fedoraproject Fedora: 34

References

• https://developer.blender.org/T94572
• https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM/
• https://www.debian.org/security/2022/dsa-5176
• https://developer.blender.org/T94572
• https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM/
• https://www.debian.org/security/2022/dsa-5176

Get alerted when CVE-2022-0546 or the next vulnerability affects your stack