Executive Summary

CVE-2026-22190 is an uncontrolled format string vulnerability in Panda3D's egg-mkfont utility (up to version 1.10.16). The vulnerability occurs because the -gp (glyph pattern) command-line option is used directly as the format string in a call to sprintf(), but only a single argument is supplied. If an attacker includes additional format specifiers in the -gp input, egg-mkfont reads unintended stack memory values and writes them into generated .egg and .png files. This leads to disclosure of stack-resident memory and pointer values. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

An attacker who can invoke egg-mkfont with a crafted -gp option can read sensitive stack-resident memory values, including pointer-sized values and memory addresses. This information disclosure can weaken security mechanisms like Address Space Layout Randomization (ASLR), making it easier for attackers to exploit other vulnerabilities. The leaked memory contents are written into output files (.egg and .png), potentially exposing sensitive process memory. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the egg-mkfont utility with crafted inputs to the -gp (glyph pattern) option that include additional format specifiers such as '%p', '%x', or positional specifiers like '%n$p'. For example, running a command like `egg-mkfont -gp '%2$s%d'` can reveal if stack memory is being disclosed in the generated .egg or .png files. Observing unexpected memory content or pointer values in these output files indicates the presence of the vulnerability. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of the vulnerable egg-mkfont utility with untrusted input for the -gp option. Restrict access to the egg-mkfont utility to trusted users only. If possible, update Panda3D to a version later than 1.10.16 where this vulnerability is fixed. Alternatively, apply patches or workarounds that sanitize or validate the -gp input before it is used as a format string in sprintf(). [1, 2]

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not specify how CVE-2026-22190 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0