CVE-2022-0546 describes a missing bounds check in the image loader of Blender 3.x and 2.93.8, leading to an out-of-bounds heap access vulnerability. This flaw affects Blender, Debian, and FedoraProject distributions. Rated 7.8 HIGH on the CVSS scale, this vulnerability can be triggered locally with low attack complexity and no privileges, requiring user interaction. Successful exploitation could result in denial of service, memory corruption, or potentially arbitrary code execution, leading to high impacts on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, indicating low public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.93.8CPE matchmatch criteria | cpe:2.3:a:blender:blender:2.93.8:*:*:*:*:*:*:* | ||
3.0CPE matchmatch criteria | cpe:2.3:a:blender:blender:3.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.