CVE-2026-22188

MediumCVSS 5.5/10Last modified Jul 14, 2026

Description

The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-457 CWE-789 CWE-908

Affected software

Vendor	Product	Versions
Panda3D	Panda3D	<= 1.10.16

References

https://github.com/panda3d/panda3dProduct
https://seclists.org/fulldisclosure/2026/Jan/9Exploit, Mailing List, Third Party Advisory
https://www.panda3d.org/Product
https://www.vulncheck.com/advisories/panda3d-deploy-stub-stack-exhaustion-via-unbounded-allocaThird Party Advisory

Timeline

Published: Jan 7, 2026
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-221899.8The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an CVE-2026-22197.5It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data s CVE-2026-221907.5The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph CVE-2026-221915.2Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by e CVE-2026-221929.9Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access pri CVE-2026-221937.5wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quo CVE-2026-221948.8GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify CVE-2026-221958.1GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is inco CVE-2026-221968.1GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided duri CVE-2026-221978.1GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters CVE-2026-221986.1GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging funct CVE-2026-221997.5Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows u