CVE-2026-22188
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The deploy-stub component in Panda3D up to version 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The alloca() function allocates memory for argv_copy and argv_copy2 based on attacker-controlled argc without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, causing a reliable crash and undefined behavior.
Risk Assessment
The risk is the ability to remotely or locally crash the Panda3D application by sending maliciously crafted arguments, leading to service disruption and potential system instability.
Recommendation
Immediately update Panda3D to a version later than 1.10.16 that includes a fix limiting stack allocation. If an update is not possible, restrict access to the application and filter command-line argument length.
Other vulnerabilities in Panda3D
See all- CVE-2026-22189Critical
The egg-mkfont utility in Panda3D up to version 1.10.16 contains a stack-based buffer overflow vulnerability due to an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation.
- CVE-2026-22190High
The egg-mkfont utility in Panda3D up to version 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) option is used directly as the format string for sprintf() with only one argument, allowing an attacker to read stack values and write them into .egg and .png files.
Original NVD description (English source)
The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS