CVE-2026-22190
📋 TL;DR
This CVE describes an uncontrolled format string vulnerability in Panda3D's egg-mkfont tool. Attackers can exploit the -gp command-line option to read stack memory and disclose sensitive information like pointer values, which could aid further attacks. Users of Panda3D versions up to 1.10.16 who process font files with egg-mkfont are affected.
💻 Affected Systems
- Panda3D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of stack memory including pointer addresses, environment variables, and potentially sensitive data that could enable ASLR bypass or facilitate further exploitation.
Likely Case
Disclosure of stack-resident memory contents and pointer values in generated .egg and .png files, potentially revealing system information useful for attackers.
If Mitigated
Limited information disclosure with no direct code execution, though leaked pointers could assist in developing more sophisticated attacks.
🎯 Exploit Status
Exploitation requires control of the -gp command-line argument to egg-mkfont. Public disclosure includes proof-of-concept demonstrating information disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.17 or later
Vendor Advisory: https://www.panda3d.org/
Restart Required: No
Instructions:
1. Check current Panda3D version. 2. Update to version 1.10.17 or later. 3. Rebuild any applications using Panda3D. 4. Regenerate any .egg font files created with vulnerable versions.
🔧 Temporary Workarounds
Input Validation for -gp Option
allValidate or sanitize the -gp argument before passing to egg-mkfont to prevent format string specifiers.
# Example: Validate -gp contains only alphanumeric characters
# Before calling egg-mkfont, ensure $GLYPH_PATTERN matches ^[a-zA-Z0-9._-]+$
Avoid Untrusted Input
allDo not use egg-mkfont with user-supplied or untrusted -gp arguments.
# Only use hardcoded or trusted glyph patterns
# egg-mkfont -gp "fixed_pattern" input.ttf output.egg
🧯 If You Can't Patch
- Isolate egg-mkfont usage to trusted environments with no untrusted input
- Monitor generated .egg and .png files for unexpected content or format string artifacts
🔍 How to Verify
Check if Vulnerable:
Check if Panda3D version is ≤1.10.16 and if egg-mkfont is used with the -gp option, especially with external input.Check Version:
panda3d --version # or check package manager for installed versionVerify Fix Applied:
Verify Panda3D version is ≥1.10.17 and test egg-mkfont with malicious -gp input to confirm no information disclosure.📡 Detection & Monitoring
Log Indicators:
- Unusual egg-mkfont process executions with complex -gp arguments
- Generated .egg/.png files containing format string artifacts or unexpected data
Network Indicators:
- N/A - Local tool exploitation
SIEM Query:
Process execution where command contains 'egg-mkfont' and argument contains '%' characters in -gp parameter