CVE-2026-22190

The record

The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single argument supplied. If an attacker provides additional format specifiers, egg-mkfont may read unintended stack values and write the formatted output into generated .egg and .png files, resulting in disclosure of stack-resident memory and pointer values.

Affected packages

Related vulnerabilities

• CVE-2026-73782 A format string vulnerability exists in the command line interface of AOS-CX that could… CWE-134
• CVE-2026-16821 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain… CWE-134
• CVE-2026-81574 In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input… CWE-134
• CVE-2026-63073 Issue summary: OpenSSL CMP response validation passed an unexpected response sender… CWE-134
• CVE-2026-17136 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… CWE-134
• CVE-2026-68553 Coturn is a free open source implementation of TURN and STUN Server. CWE-134
• CVE-2026-15961 IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through… CWE-134
• CVE-2026-12004 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0… CWE-134