CVE-2026-22190: Panda3D <= 1.10.16 egg-mkfont Format String Information Disclosure
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single argument supplied. If an attacker provides additional format specifiers, egg-mkfont may read unintended stack values and write the formatted output into generated .egg and .png files, resulting in disclosure of stack-resident memory and pointer values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Panda3D/egg-mkfontto a version that resolves this vulnerability.Fixed in 1.10.16 - Compensating control
Avoid using untrusted input for the egg-mkfont -gp (glyph pattern) command-line option; since -gp is used directly as the format string for sprintf(), only supply trusted, controlled glyph patterns.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22190?
CVE-2026-22190 has been classified as a high-severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-22190?
To fix CVE-2026-22190, upgrade Panda3D to version 1.10.17 or later where the vulnerability has been patched.
What software is affected by CVE-2026-22190?
CVE-2026-22190 affects Panda3D versions up to and including 1.10.16.
What kind of vulnerability is CVE-2026-22190?
CVE-2026-22190 is an uncontrolled format string vulnerability that can be exploited through the -gp command-line option.
Can CVE-2026-22190 be exploited remotely?
Yes, CVE-2026-22190 can potentially be exploited remotely if the vulnerable version of Panda3D is used in an exposed environment.