PT-2026-2163 · Panda3D · Panda3D

Ron Edgerson · Published 2026-01-07 · Updated 2026-05-26 · CVE-2026-22189

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Panda3D versions up to and including 1.10.16

Description The software contains a stack-based buffer overflow issue because of the use of an unbounded sprintf() call with input controlled by an attacker. When creating glyph filenames, the software formats a glyph pattern supplied by the user (-gp) into a fixed-size stack buffer without validating the length. Providing a glyph pattern string that is too long can cause the stack buffer to overflow, leading to memory corruption and a crash. Depending on the build configuration and execution environment, this overflow may also allow for arbitrary code execution.

Recommendations Versions prior to 1.10.16 are not affected. Versions up to and including 1.10.16 are affected.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2026-22189

Affected Products

Panda3D

References · 9

• 🔥 https://seclists.org/fulldisclosure/2026/Jan/10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-22189 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22189 · Vendor Advisory
• https://github.com/panda3d/panda3d · Note
• https://twitter.com/CVEnew/status/2009020528200462700 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009014292192862381 · Twitter Post
• https://vulncheck.com/advisories/panda3d-egg-mkfont-stack-buffer-overflow · Note
• https://t.me/cveNotify/164696 · Telegram Post
• https://panda3d.org · Note