CVE Intelligence
Analysis AI-assisted

CVE-2026-22189: Panda3D egg-mkfont Stack-Based Buffer Overflow

Panda3D's egg-mkfont utility, in versions up to and including 1.10.16, has a stack-based buffer overflow caused by an unbounded sprintf() call that handles a user-supplied glyph pattern. The record reports memory corruption and a deterministic crash, and says arbitrary code execution may be possible depending on build configuration and environment. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a stack-based buffer overflow (CWE-787, out-of-bounds write) in the egg-mkfont utility of Panda3D. The flaw lies in handling the glyph pattern option (-gp), which is formatted into a fixed-size stack buffer without length validation.

Impact

  • The record describes memory corruption and a deterministic crash.
  • The record states that, depending on build configuration and execution environment, the overflow may also be exploitable for arbitrary code execution.
  • NVD scores the issue CVSS 3.1 9.8 (critical). VulnCheck scores it CVSS 4.0 6.9.

Affected products and versions

  • Products listed: Cmu Panda3d and Panda3D Panda3D.
  • Affected range: up to and including 1.10.16.
  • The record lists no fixed version.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • The record gives an SSVC exploitation value of poc and an EPSS probability of 0.00519 (percentile 0.43255).

Remediation and mitigation

  • No fixed version is listed in the record, which does not mean no fix exists. Check the Panda3D project site and the Panda3D GitHub repository for updates.
  • Until a fix is confirmed, avoid running egg-mkfont with untrusted or unvalidated glyph pattern input.
  • Run asset build tools in isolated, least-privilege environments.
  • After an update is available, rebuild and redeploy from a verified source.

Detection guidance

  • Monitor build pipelines and tool invocations for egg-mkfont crashes or abnormal terminations.
  • Review build inputs for unusually long glyph pattern arguments before processing.
  • Track process crashes and memory-fault events on systems where egg-mkfont runs.

Limitations of the available information

  • The record does not describe the affected build configurations, the buffer size or the platforms tested.
  • The record does not include a fixed version or vendor patch.
  • A mailing-list reference tagged as exploit-related is listed. Its content was not relied on for this analysis, and it does not establish exploitation in the wild.
  • The EPSS date in the record (2026-10-23) is later than the publication date, so the EPSS figures should be treated with caution.

Frequently asked questions

Which Panda3D versions are affected by CVE-2026-22189?

The record lists the affected range as up to and including 1.10.16 for the Cmu Panda3d and Panda3D Panda3D entries. The record does not list a fixed version.

Is CVE-2026-22189 known to be actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

What should administrators do while no fix is listed?

Avoid running egg-mkfont with untrusted glyph pattern input, run build tools in isolated least-privilege environments, and watch the project site and repository for an update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.