blender - Debian Package Tracker

general

source: blender (main)
version: 5.2.3+dfsg-1
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Antoine Lassagne (DMD) – Matteo F. Vescovi (DMD)
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.83.5+dfsg-5+deb11u1
o-o-sec: 2.83.5+dfsg-5+deb11u1
oldstable: 3.4.1+dfsg-2
stable: 4.3.2+dfsg-2
testing: 5.2.2+dfsg-1
unstable: 5.2.3+dfsg-1

versioned links

2.83.5+dfsg-5+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.1+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.3.2+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.3+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

blender (19 bugs: 0, 12, 7, 0)
blender-data (3 bugs: 0, 2, 1, 0)

action needed

A new upstream version is available: 5.3.0 high

A new upstream version 5.3.0 is available, you should consider packaging it.

Created: 2026-10-26 Last update: 2026-11-13 01:30

lintian reports 51 warnings high

Lintian reports 51 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-03 Last update: 2026-11-11 05:30

5 security issues in trixie high

There are 5 open security issues in trixie.

5 important issues:

CVE-2026-119718: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
CVE-2026-119719: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.
CVE-2026-119720: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
CVE-2026-119721: Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
CVE-2026-119722: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

Created: 2026-10-31 Last update: 2026-11-11 02:02

5 security issues in forky high

There are 5 open security issues in forky.

5 important issues:

CVE-2026-119718: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
CVE-2026-119719: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.
CVE-2026-119720: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
CVE-2026-119721: Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
CVE-2026-119722: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

Created: 2026-11-08 Last update: 2026-11-11 02:02

5 security issues in bookworm high

There are 5 open security issues in bookworm.

5 important issues:

CVE-2026-119718: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
CVE-2026-119719: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.
CVE-2026-119720: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
CVE-2026-119721: Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
CVE-2026-119722: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

Created: 2026-10-31 Last update: 2026-11-11 02:02

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

blender-data could have its dependency on python3 annotated with :any

Created: 2016-09-14 Last update: 2026-11-13 04:17

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-11-10 Last update: 2026-11-13 00:00

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-11-05 Last update: 2026-11-05 15:01

debian/patches: 4 patches to forward upstream low

Among the 4 debian patches available in version 5.2.3+dfsg-1 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-11-11 07:18

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2023-08-22 Last update: 2023-08-22 10:04

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2025-02-21 Last update: 2026-11-10 23:01

testing migrations

This package is part of the ongoing testing transition known as auto-openimageio. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-gflags transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-opencolorio transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-fmtlib transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-google-glog transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the fmtlib-12 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migrates after: openimageio
- Migration status for blender (5.2.2+dfsg-1 to 5.2.3+dfsg-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Lintian check waiting for test results on riscv64 - info
- ∙ ∙ Too young, only 2 of 5 days old
- ∙ ∙ Depends: blender openimageio
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/b/blender.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-11-10] Accepted blender 5.2.3+dfsg-1 (source) into unstable (Antoine Lassagne)
[2026-11-09] blender 5.2.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-10-27] blender REMOVED from testing (Debian testing watch)
[2026-10-14] Accepted blender 5.2.2+dfsg-1 (source) into unstable (Antoine Lassagne)
[2026-10-13] Accepted blender 5.0.1+dfsg-9 (source) into unstable (Antoine Lassagne)
[2026-10-12] Accepted blender 5.0.1+dfsg-8 (source) into unstable (Antoine Lassagne)
[2026-10-08] Accepted blender 5.0.1+dfsg-7 (source) into unstable (Antoine Lassagne)
[2026-10-07] blender 5.0.1+dfsg-6 MIGRATED to testing (Debian testing watch)
[2026-10-02] Accepted blender 5.0.1+dfsg-6 (source) into unstable (Antoine Lassagne)
[2026-09-11] blender 5.0.1+dfsg-5 MIGRATED to testing (Debian testing watch)
[2026-09-03] Accepted blender 5.0.1+dfsg-5 (source) into unstable (Antoine Lassagne)
[2026-09-02] blender 5.0.1+dfsg-4 MIGRATED to testing (Debian testing watch)
[2026-08-28] Accepted blender 5.0.1+dfsg-4 (source) into unstable (Matthias Klumpp)
[2026-07-29] blender 5.0.1+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-07-20] Accepted blender 5.0.1+dfsg-3 (source) into unstable (Antoine Lassagne) (signed by: Paride Legovini)
[2026-07-02] Accepted blender 5.0.1+dfsg-2 (source) into experimental (Antoine Lassagne) (signed by: Paride Legovini)
[2026-03-09] Accepted blender 5.0.1+dfsg-1 (source) into experimental (Antoine Lassagne) (signed by: Paride Legovini)
[2026-01-09] blender REMOVED from testing (Debian testing watch)
[2025-02-08] blender 4.3.2+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-02-02] Accepted blender 4.3.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2025-01-11] Accepted blender 4.3.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-12-04] Accepted blender 4.3.0+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-10-28] Accepted blender 4.2.3+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2024-10-26] Accepted blender 4.2.3+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2024-10-25] Accepted blender 4.2.3+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-09-28] Accepted blender 4.2.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-09-09] Accepted blender 4.2.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-06-26] Accepted blender 4.1.1+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2024-06-16] Accepted blender 4.1.1+dfsg-2 (source) into experimental (Matteo F. Vescovi)
[2024-06-16] Accepted blender 4.1.1+dfsg-1 (source) into experimental (Matteo F. Vescovi)

bugs [bug history graph]

all: 23 25
RC: 0
I&N: 16
M&W: 7 9
F&P: 0
patch: 0

links

homepage
lintian (0, 51)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 100)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.1+dfsg-6
14 bugs