cvedb.io
CVE-2026-22189
CRITICAL · CVSS 9.8
EPSS exploitation probability: 0%
Published 2026-01-07T21:16:03.067 · Last modified 2026-06-17T10:19:30.720

Summary

The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation. Supplying an excessively long glyph pattern string can overflow the stack buffer, resulting in memory corruption and a deterministic crash. Depending on build configuration and execution environment, the overflow may also be exploitable for arbitrary code execution.

Affected products

cmu — panda3d

Does this affect you?

Add your gear to cvedb and we'll alert you only when cmu ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.