ufbx (5955c5c0) is dual-licensed (MIT or the second alternative per LICENSE); Blender v5.2.2 (tag -> d13f752e) bundles ufbx v0.20.0 (a63ff0a, 2025-06-16) unmodified, so later upstream fixes are not in that Blender release (producer cites v0.21.x/v0.23.1 fixes; not...

ufbx (5955c5c0) is dual-licensed (MIT or the second alternative per LICENSE); Blender v5.2.2 (tag -> d13f752e) bundles ufbx v0.20.0 (a63ff0a, 2025-06-16) unmodified, so later upstream fixes are not in that Blender release (producer cites v0.21.x/v0.23.1 fixes; not reinspected). Curator correction 2026-10-23 (discovery audit record C3-B684-06; sources re-fetched 2026-10-23, excerpts re-located by curator GET): Problem. Candidates M3-02 and M3-04 say Blender bundles ufbx v0.20.0 unmodified and is three minor releases behind upstream v0.23.1, so Blender's FBX importer lacks recent upstream fixes. Nature: (e) changed since / missing scope. Conditions. True for Blender 5.2.x only. Method. The 5.2 release branch README.blender still says v0.20.0, but Blender main's README.blender now records upstream v0.23.1 (2026-09-25), so a later release may carry the fixes. Failure modes. Telling an agent that Blender 'lacks' the v0.21-v0.23 fixes is wrong for main/development builds. Limitations. Whether and when main ships in a release was not established. Version and date. 2026-10-23. Curator qualifications: Loader scope, axis/unit conversion, animation baking, constraint handling and test-data provenance (F0-F5, F7, F8) not reinspected; the large external test dataset carries per-asset licences (producer). Upstream fix list after v0.20.0 not reinspected. Static reading only; no .abc or .fbx file read, no build. Curator amendment CA-AM-0092 (2026-10-22): Reinspected 2026-10-22 with GitHub GETs. ufbx has no CHANGELOG file and no GitHub releases, only tags. The compare v0.20.0...v0.23.1 (readback 941f22ce819134d2: 170 commits ahead) shows 'Fix deflate dynamic Huffman codelength init' (e06d9f28, PR #232) before the v0.21.0 bump, and 'Deflate fuzz fixes' (PR #235) before v0.21.1. A fuzzing campaign from 2026-08-23 to 2026-09-24 adds overflow checks (threaded ASCII parsing, NURBS, ufbxi_clean_string_utf8, 32-bit guards, filename overflow) and clean DEFLATE truncation handling, then 'Bump version to v0.23.1'. Tag v0.23.1 = 26a482ae (2026-09-25). Primary security statement: the repository's security-advisories endpoint (readback 81d9ee4966694cf0) lists GHSA-6j9m-9g7j-w7vg 'Filename buffer overflow' and GHSA-7m5m-93fx-xcf5 'Windows filename buffer overflow'. Both are severity medium with no CVE, published 2026-09-25, vulnerable '< 0.23.1' and '< 0.11.5', patched 0.23.1 and 0.11.5. So Blender 5.2.2's bundled ufbx v0.20.0 (CA-B031) is inside the advisories' vulnerable range by version number. Whether Blender's importer reaches the affected filename path was not checked (code inference not done; nothing executed). The producer's 'memory-safety fixes in v0.23.1' is supported by the advisories. The DEFLATE fixes are in v0.21.0/0.21.1, matching the producer. For untrusted FBX, the curator recommendation is ufbx >= 0.23.1 (or 0.11.5 on the old line). This is a proposal, not a security clearance. Curator amendment CA-AM-0093 (2026-10-22): Correction to CA-AM-0092. In both advisories the '< 0.11.5' / patched '0.11.5' entry has package ecosystem 'rust', name 'ufbx': the Rust crate. It is not an older C release line. The C library entry (no ecosystem) is '< 0.23.1', patched 0.23.1. Read the recommendation as: C library ufbx >= 0.23.1; Rust crate ufbx >= 0.11.5. Limitations: Static reading only; no .abc or .fbx file read, no build. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://github.com/ufbx/ufbx",
      "note": "ufbx LICENSE at 5955c5c0; blender extern/ufbx/README.blender at d13f752e; GET /repos/blender/blender/git/ref/tags/v5.2.2"
    },
    {
      "url": "https://raw.githubusercontent.com/blender/blender/main/extern/ufbx/README.blender",
      "note": "correction source (record C3-B684-06): README.blender line 5; README.blender line 5"
    },
    {
      "url": "https://raw.githubusercontent.com/blender/blender/blender-v5.2-release/extern/ufbx/README.blender",
      "note": "correction source (record C3-B684-06): README.blender line 5; README.blender line 5"
    }
  ]
}