Executive brief
Panda3D is a popular open-source game engine used for 3D rendering and game development. A security flaw in its font-processing utility, egg-mkfont, allows a user to provide specially crafted commands that trick the software into leaking sensitive internal memory. This could allow an attacker to bypass security protections like ASLR or gain insights into the system's memory layout, potentially facilitating more complex attacks.
Technical details
An uncontrolled format string vulnerability exists in the egg-mkfont utility of Panda3D (<= 1.10.16). The root cause is located in eggMakeFont.cxx, where the user-supplied -gp (glyph pattern) command-line argument is passed directly as the format string to sprintf() with only a single argument provided. By injecting additional format specifiers (e.g., %p, %x, %s), an attacker can cause the utility to read arbitrary values from the stack. This leaked information is then written into the resulting .egg and .png output files. This vulnerability can be used to disclose stack-resident pointers and memory addresses, effectively weakening ASLR.
Affected products
- CMU/Disney Panda3D up to and including 1.10.16
Timeline
- 2026-01-01: disclosed: Initial disclosure on Full Disclosure mailing list
- 2026-01-07: advisory: CVE published and NVD entry created