Executive brief
Panda3D is an open-source game engine used for 3D rendering and game development. A vulnerability in its font processing utility, egg-mkfont, allows an attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted font pattern. This could lead to a loss of system availability or a compromise of the environment where the utility is running.
Technical details
A stack-based buffer overflow exists in the egg-mkfont utility of Panda3D (<= 1.10.16) within the EggMakeFont::make_tref function. The vulnerability is caused by the use of an unbounded sprintf() call that copies a user-controlled glyph pattern string (provided via the -gp command-line argument) into a fixed-size 1024-byte stack buffer without length validation. An attacker can exploit this by providing an excessively long string, leading to memory corruption and a deterministic crash. Depending on the build environment and presence of stack protections, this may be leveraged for arbitrary code execution. The issue was disclosed in January 2026.
Affected products
- Panda3D Panda3D up to and including 1.10.16
Timeline
- 2026-01-01: disclosed: Initial disclosure on Full Disclosure mailing list
- 2026-01-07: advisory: NVD and VulnCheck published advisory data