# CVE-2026-22190: Panda3D egg-mkfont format string vulnerability in -gp option

Source: https://junglewise.ai/threats/cve-2026-22190-panda3d-egg-mkfont-format-string-vulnerability-in-gp-option  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-07. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-22190 · Severity: high · CVSS 7.5 · Published 2026-01-07

Panda3D is a popular open-source game engine used for 3D rendering and game development. A security flaw in its font-processing utility, egg-mkfont, allows a user to provide specially crafted commands that trick the software into leaking sensitive internal memory. This could allow an attacker to bypass security protections like ASLR or gain insights into the system's memory layout, potentially facilitating more complex attacks.

Technologies: [Cmu Panda3d](https://junglewise.ai/threats/technologies/panda3d). Vendors: [Cmu](https://junglewise.ai/threats/vendors/cmu).

## Quick answers

**Is CVE-2026-22190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22190 being exploited in the wild.

**How severe is CVE-2026-22190?** High severity, with a CVSS score of 7.5, published 7 January 2026.

**Which products and versions are affected?** CMU/Disney Panda3D up to and including 1.10.16.

**Is there a fix for CVE-2026-22190?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-22190 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-22190?** Check whether you run Cmu Panda3d. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled format string vulnerability exists in the egg-mkfont utility of Panda3D (<= 1.10.16). The root cause is located in eggMakeFont.cxx, where the user-supplied -gp (glyph pattern) command-line argument is passed directly as the format string to sprintf() with only a single argument provided. By injecting additional format specifiers (e.g., %p, %x, %s), an attacker can cause the utility to read arbitrary values from the stack. This leaked information is then written into the resulting .egg and .png output files. This vulnerability can be used to disclose stack-resident pointers and memory addresses, effectively weakening ASLR.

## Affected products

- CMU/Disney Panda3D up to and including 1.10.16

## Timeline

- 2026-01-01: disclosed: Initial disclosure on Full Disclosure mailing list
- 2026-01-07: advisory: CVE published and NVD entry created

## References

- [https://github.com/panda3d/panda3d](https://github.com/panda3d/panda3d)
- [https://seclists.org/fulldisclosure/2026/Jan/11](https://seclists.org/fulldisclosure/2026/Jan/11)
- [https://www.panda3d.org/](https://www.panda3d.org/)
- [https://www.vulncheck.com/advisories/panda3d-egg-mkfont-format-string-information-disclosure](https://www.vulncheck.com/advisories/panda3d-egg-mkfont-format-string-information-disclosure)

## Related threats

- [Panda3D egg-mkfont stack buffer overflow in glyph pattern processing](https://junglewise.ai/threats/cve-2026-22189-panda3d-egg-mkfont-stack-buffer-overflow-in-glyph-pattern)
- [Panda3D denial of service via unbounded stack allocation in deploy-stub](https://junglewise.ai/threats/cve-2026-22188-panda3d-denial-of-service-via-unbounded-stack-allocation-in)