CVE-2026-22189 is a stack based buffer overflow in the egg-mkfont utility in Panda3D 1.10.16 and earlier. A very long glyph pattern argument overflows a fixed size buffer, causing a crash and possibly code execution. NVD scores it 9.8, while VulnCheck rates it medium. No fixed version is confirmed, so check Panda3D releases.
What's affected
- Product: Panda3D, the egg-mkfont command line tool
- Affected: versions up to and including 1.10.16
- Fixed: not confirmed. The record and the advisory we checked name no patched version, so check the Panda3D release notes
- Entry point: the glyph pattern option of egg-mkfont
- Status: not in the CISA Known Exploited Vulnerabilities catalog
The scores differ by source. NVD lists 9.8 with a network vector. VulnCheck lists 6.9 (medium) on CVSS version 4 with a local attack vector, which fits a command line tool that runs where the user starts it.
How to check if you're exposed
Find out whether Panda3D is installed and which version:
pip show panda3d
which egg-mkfont
If egg-mkfont exists and the version is 1.10.16 or earlier, you have the vulnerable tool. Many game and asset teams have Panda3D in a Python environment only for its rendering library and never use the font tool.
Then ask how the tool is called. It matters most when the glyph pattern option can be filled from outside input, for example by a web service or a build job that processes data from other people. Manual use with your own arguments is a smaller risk.
What to do now
- Find every environment with Panda3D 1.10.16 or earlier, including build images and developer machines.
- Check the Panda3D release notes and repository for a version that fixes the overflow, and update when one is available.
- Remove egg-mkfont from images and environments that do not use it.
- Do not pass untrusted text into the glyph pattern option. Validate its length first if a wrapper script builds the command.
- Run asset conversion jobs in a container with no access to secrets.
Why it matters
The tool builds a file name for each glyph by formatting a user supplied pattern into a buffer of fixed size. The record says it uses sprintf without a length limit, so a long enough pattern writes past the end of the buffer on the stack. The weakness is CWE-121, a stack based buffer overflow, and CWE-787, out-of-bounds write.
On the stack, an overflow usually crashes the program. The record says the crash is deterministic, and that depending on the build configuration the overflow may also allow code execution. How far the overflow can be pushed depends on the build and the environment, as the record notes.
The attack path is the thing to weigh. A command line utility is only exposed when someone else controls its arguments. Tools like this still end up inside build pipelines and asset services, and that is where a crash or worse becomes a problem.
The safe fix is a bounded formatting call. Until a release includes it, limit who can reach the option.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the scores differ so much?
NVD uses a network vector and scores 9.8. VulnCheck uses a local vector on CVSS 4.0 and scores 6.9. The tool is a command line program, so exposure depends on how you call it.
Is there a patched release?
We could not confirm one. The record and the advisory name no fixed version, so check the Panda3D release notes.
Sources
Last reviewed: 19 October 2026.
