CVE-2026-22189
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The egg-mkfont utility in Panda3D up to version 1.10.16 contains a stack-based buffer overflow vulnerability due to an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation.
Risk Assessment
Supplying an excessively long glyph pattern string can overflow the stack buffer, resulting in memory corruption and a deterministic crash. Depending on build configuration and execution environment, the overflow may be exploitable for arbitrary code execution, posing a significant risk to the organization.
Recommendation
Immediately update Panda3D to version 1.10.17 or later, which includes a fix for this vulnerability. If an update is not possible, restrict access to the egg-mkfont utility to trusted users only.
Other vulnerabilities in Panda3D
See all- CVE-2026-22190High
The egg-mkfont utility in Panda3D up to version 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) option is used directly as the format string for sprintf() with only one argument, allowing an attacker to read stack values and write them into .egg and .png files.
- CVE-2026-22188Medium
The deploy-stub component in Panda3D up to version 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The alloca() function allocates memory for argv_copy and argv_copy2 based on attacker-controlled argc without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, causing a reliable crash and undefined behavior.
Original NVD description (English source)
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation. Supplying an excessively long glyph pattern string can overflow the stack buffer, resulting in memory corruption and a deterministic crash. Depending on build configuration and execution environment, the overflow may also be exploitable for arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS