Vulnerability Details CVE-2026-22189
Panda3D versions up to and including 1.10.16 egg-mkfont contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation. Supplying an excessively long glyph pattern string can overflow the stack buffer, resulting in memory corruption and a deterministic crash. Depending on build configuration and execution environment, the overflow may also be exploitable for arbitrary code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 2.5%
CVSS Severity
CVSS v3 Score 9.8
References
Products affected by CVE-2026-22189
-
cpe:2.3:a:cmu:panda3d:1.10.0
-
cpe:2.3:a:cmu:panda3d:1.10.1
-
cpe:2.3:a:cmu:panda3d:1.10.10
-
cpe:2.3:a:cmu:panda3d:1.10.11
-
cpe:2.3:a:cmu:panda3d:1.10.12
-
cpe:2.3:a:cmu:panda3d:1.10.13
-
cpe:2.3:a:cmu:panda3d:1.10.14
-
cpe:2.3:a:cmu:panda3d:1.10.15
-
cpe:2.3:a:cmu:panda3d:1.10.16
-
cpe:2.3:a:cmu:panda3d:1.10.2
-
cpe:2.3:a:cmu:panda3d:1.10.3
-
cpe:2.3:a:cmu:panda3d:1.10.4
-
cpe:2.3:a:cmu:panda3d:1.10.4.1
-
cpe:2.3:a:cmu:panda3d:1.10.5
-
cpe:2.3:a:cmu:panda3d:1.10.6
-
cpe:2.3:a:cmu:panda3d:1.10.7
-
cpe:2.3:a:cmu:panda3d:1.10.8
-
cpe:2.3:a:cmu:panda3d:1.10.9
-
cpe:2.3:a:cmu:panda3d:1.8.0
-
cpe:2.3:a:cmu:panda3d:1.9.0
-
cpe:2.3:a:cmu:panda3d:1.9.1
-
cpe:2.3:a:cmu:panda3d:1.9.2
-
cpe:2.3:a:cmu:panda3d:1.9.3
-
cpe:2.3:a:cmu:panda3d:1.9.4