PT-2026-2162 · Panda3D · Panda3D

Ron Edgerson · Published 2026-01-07 · Updated 2026-05-26 · CVE-2026-22188

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Panda3D versions up to and including 1.10.16

Description Panda3D deploy-stub contains a denial of service condition resulting from unbounded stack allocation. The deploy-stub executable uses alloca() to allocate argv copy and argv copy2 based on the argc value, which is directly controlled by the attacker, without any validation. Providing a large number of command-line arguments can exhaust stack space and lead to a crash and undefined behavior during Python interpreter initialization.

Recommendations Versions prior to 1.10.16 are not affected. Update to a version later than 1.10.16.

Exploit

Fix

DoS

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

CWE-789

CWE-457

Related Identifiers

CVE-2026-22188

Affected Products

Panda3D

References · 9

• 🔥 https://seclists.org/fulldisclosure/2026/Jan/9 · Exploit
• https://osv.dev/vulnerability/CVE-2026-22188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22188 · Security Note
• https://github.com/panda3d/panda3d · Note
• https://twitter.com/VulmonFeeds/status/2009019412070773068 · Twitter Post
• https://twitter.com/CVEnew/status/2009020526308831262 · Twitter Post
• https://vulncheck.com/advisories/panda3d-deploy-stub-stack-exhaustion-via-unbounded-alloca · Note
• https://t.me/cveNotify/164695 · Telegram Post
• https://panda3d.org · Note