CVE-2026-22190
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The egg-mkfont utility in Panda3D up to version 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) option is used directly as the format string for sprintf() with only one argument, allowing an attacker to read stack values and write them into .egg and .png files.
Risk Assessment
The risk involves leakage of sensitive stack memory, such as pointer addresses, which could facilitate further attacks on the system or application.
Recommendation
It is recommended to immediately update Panda3D to a version newer than 1.10.16 that fixes this vulnerability, and avoid passing untrusted data to the -gp option.
Other vulnerabilities in Panda3D
See all- CVE-2026-22189Critical
The egg-mkfont utility in Panda3D up to version 1.10.16 contains a stack-based buffer overflow vulnerability due to an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation.
- CVE-2026-22188Medium
The deploy-stub component in Panda3D up to version 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The alloca() function allocates memory for argv_copy and argv_copy2 based on attacker-controlled argc without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, causing a reliable crash and undefined behavior.
Original NVD description (English source)
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single argument supplied. If an attacker provides additional format specifiers, egg-mkfont may read unintended stack values and write the formatted output into generated .egg and .png files, resulting in disclosure of stack-resident memory and pointer values.