Executive brief
Panda3D is an open-source game engine used for 3D rendering and game development. A vulnerability in its deployment component allows a local user to crash the application by providing an excessive number of command-line arguments. This can lead to a denial-of-service condition, preventing the software from starting or operating correctly.
Technical details
A vulnerability exists in the deploy-stub component of Panda3D (up to v1.10.16) due to the use of the alloca() function with unvalidated input. Specifically, the executable allocates memory for argv_copy and argv_copy2 based directly on the attacker-controlled argc (argument count) value. By supplying a very large number of command-line arguments, a local attacker can trigger stack exhaustion. This leads to the propagation of uninitialized stack memory into the Python interpreter's initialization routines, causing a reliable crash (DoS) and undefined behavior. The issue has been verified using MemorySanitizer (MSAN) as a use-of-uninitialized-value originating from stack memory.
Affected products
- Panda3D Panda3D up to and including 1.10.16
Timeline
- 2026-01-01: disclosed: Initial disclosure on Full Disclosure mailing list
- 2026-01-07: advisory: NVD and VulnCheck advisory published