CVE-2026-22188
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jan 7, 2026
CISA due date
—
The record
The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112897 Pillow is a Python imaging library. CWE-908
- CVE-2026-109273 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure… CWE-908
- CVE-2026-107676 FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in… CWE-908
- CVE-2026-102635 ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory… CWE-908
- CVE-2026-87647 Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-908
- CVE-2026-87642 Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-908
- CVE-2026-87576 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36… CWE-908
- CVE-2026-87555 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36… CWE-908