CVE-2009-3850: Blender

High severity, CVSS 9.3. EPSS: 10% chance of exploitation in the next 30 days.

Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.

Affected products

• Blender Blender: version 2.34 only; version 2.35a only; version 2.40 only; version 2.49b only

Published 2009-11-06. Last modified 2026-06-16.