Is CVE-2026-22190 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22190 being exploited in the wild.

How severe is CVE-2026-22190?

High severity, with a CVSS score of 7.5, published 7 January 2026.

Which products and versions are affected?

CMU/Disney Panda3D up to and including 1.10.16.

Is there a fix for CVE-2026-22190?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-22190 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-22190?

Check whether you run Cmu Panda3d. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22190: Panda3D egg-mkfont format string vulnerability in -gp option

CVE-2026-22190 · Severity: high · CVSS 7.5 · Published 2026-01-07

Panda3D is a popular open-source game engine used for 3D rendering and game development. A security flaw in its font-processing utility, egg-mkfont, allows a user to provide specially crafted commands that trick the software into leaking sensitive internal memory. This could allow an attacker to bypass security protections like ASLR or gain insights into the system's memory layout, potentially facilitating more complex attacks.

Technologies: Cmu Panda3d. Vendors: Cmu.

Quick answers

Is CVE-2026-22190 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22190 being exploited in the wild.
How severe is CVE-2026-22190?: High severity, with a CVSS score of 7.5, published 7 January 2026.
Which products and versions are affected?: CMU/Disney Panda3D up to and including 1.10.16.
Is there a fix for CVE-2026-22190?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22190 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-22190?: Check whether you run Cmu Panda3d. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled format string vulnerability exists in the egg-mkfont utility of Panda3D (<= 1.10.16). The root cause is located in eggMakeFont.cxx, where the user-supplied -gp (glyph pattern) command-line argument is passed directly as the format string to sprintf() with only a single argument provided. By injecting additional format specifiers (e.g., %p, %x, %s), an attacker can cause the utility to read arbitrary values from the stack. This leaked information is then written into the resulting .egg and .png output files. This vulnerability can be used to disclose stack-resident pointers and memory addresses, effectively weakening ASLR.

Affected products

CMU/Disney Panda3D up to and including 1.10.16

Timeline

2026-01-01: disclosed: Initial disclosure on Full Disclosure mailing list
2026-01-07: advisory: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.