CVE-2026-22190

Deeper analysis

CVE-2026-22190 is an uncontrolled format string vulnerability (CWE-134) in the egg-mkfont tool of Panda3D, affecting versions up to and including 1.10.16. The vulnerability arises because the -gp (glyph pattern) command-line option is passed directly as the format string to sprintf() with only a single argument provided. An attacker can supply additional format specifiers via this option, causing egg-mkfont to read unintended values from the stack and incorporate the formatted output into the generated .egg and .png files, leading to disclosure of stack-resident memory and pointer values. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The vulnerability can be exploited remotely by any unauthenticated attacker with network access to a system running the affected egg-mkfont tool, requiring low complexity and no user interaction. Exploitation involves crafting a malicious -gp argument with format specifiers such as %p or %x, tricking a user or automated process into invoking egg-mkfont with the tainted input. Successful exploitation results in information disclosure, as the leaked stack data—including memory addresses and potentially sensitive values—is embedded in the output .egg and .png files, which could then be retrieved by the attacker.

Mitigation details and patches are documented in advisories available at https://seclists.org/fulldisclosure/2026/Jan/11, https://www.vulncheck.com/advisories/panda3d-egg-mkfont-format-string-information-disclosure, the Panda3D GitHub repository at https://github.com/panda3d/panda3d, and the official site at https://www.panda3d.org/. Security practitioners should review these sources for updated versions and apply patches promptly to vulnerable Panda3D installations.