CVE-2022-2833 Denial of service in Blender

What is CVE-2022-2833?

CVE-2022-2833 is a high-severity denial of service vulnerability in Blender, published on 16 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Endless Infinite loop in Blender-thumnailing due to logical bugs.

Weakness: CWE-835

Which versions are affected by CVE-2022-2833?

It affects 1 product.

Products include Blender Blender.

How do I fix CVE-2022-2833?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-2833 being exploited?

There is no known exploitation of CVE-2022-2833 in the wild and no public exploit code.

Other vulnerabilities in Blender

• CVE-2009-3850 Code injection in n/a Critical 9.3
• CVE-2007-1253 Code injection in n/a Critical 9.3
• CVE-2017-12081 Integer overflow in Blender High 8.8
• CVE-2017-12082 Integer overflow in Blender High 8.8
• CVE-2017-12086 Integer overflow in Blender High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2024-EN97769, DEBIAN-CVE-2022-2833, GHSA-78r9-qj6x-mw32, UBUNTU-CVE-2022-2833.