The vulnerability exists in Blender versions 3.0.0 through 5.1.2 where the member_index field in the SDNA block of a .blend file is used as an array index without bounds checking in the sdna_expand_names() function. An attacker can supply a crafted .blend file with a malicious signed short member_index value that is out-of-bounds, causing an invalid pointer to be passed to strlen(). This leads to either a segmentation fault (SIGSEGV) crash or disclosure of adjacent heap memory. The vulnerability affects multiple Ubuntu-distributed Blender package versions as listed, spanning Ubuntu LTS releases from 16.04 through 26.04. There is no indication of known exploits in the wild. No official patch or vendor advisory is provided in the data.

Successful exploitation can cause Blender to crash (denial of service) or leak adjacent heap memory contents, potentially exposing sensitive information. The vulnerability requires a user to open a malicious .blend file, and user interaction is needed. The attack vector is local (AV:L), with low complexity and no privileges required. The impact is primarily a crash or limited memory disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid opening untrusted or suspicious .blend files to mitigate risk. Monitor official Ubuntu and Blender security advisories for updates and apply fixes once released.