CVE-2026-22190 Panda3D <= 1.10.16 egg-mkfont Format String Information Disclosure
An attacker can exploit a format string vulnerability in the egg-mkfont utility to disclose stack memory and pointer values via crafted command-line arguments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22190?
CVE-2026-22190 is a medium-severity vulnerability in Panda3D, published on 7 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single argument supplied. If an attacker provides additional format specifiers, egg-mkfont may read unintended stack values and write the formatted output into generated .egg and .png files, resulting in disclosure of stack-resident memory and pointer values.
Weakness: CWE-134
Which versions are affected by CVE-2026-22190?
It affects 1 product.
Products include Cmu Panda3d.
How do I fix CVE-2026-22190?
No fix has been published for CVE-2026-22190 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22190 exists.
Other vulnerabilities in Panda3D
Sources
Also known as GHSA-mmrr-c2j6-cqfp.