CVE-2026-22188

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-22188
The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/panda3d/panda3d Product
https://seclists.org/fulldisclosure/2026/Jan/9 Exploit Mailing List Third Party Advisory
https://www.panda3d.org/ Product
https://www.vulncheck.com/advisories/panda3d-deploy-stub-stack-exhaustion-via-unbounded-alloca Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cmu:panda3d:*:*:*:*:*:*:*:*
History

26 May 2026, 14:16

Type Values Removed Values Added
Summary
  • (es) Las versiones de Panda3D hasta la 1.10.16 inclusive deploy-stub contienen una vulnerabilidad de denegación de servicio debido a una asignación de pila ilimitada. El ejecutable deploy-stub asigna argv_copy y argv_copy2 utilizando alloca() basándose directamente en el valor argc controlado por el atacante sin validación. Suministrar un gran número de argumentos de línea de comandos puede agotar el espacio de la pila y propagar memoria de pila no inicializada a la inicialización del intérprete de Python, lo que resulta en un fallo fiable y comportamiento indefinido.
Summary (en) Panda3D versions up to and including 1.10.16 deploy-stub contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior. (en) The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.

12 Jan 2026, 18:00

Type Values Removed Values Added
References () https://github.com/panda3d/panda3d - () https://github.com/panda3d/panda3d - Product
References () https://seclists.org/fulldisclosure/2026/Jan/9 - () https://seclists.org/fulldisclosure/2026/Jan/9 - Exploit, Mailing List, Third Party Advisory
References () https://www.panda3d.org/ - () https://www.panda3d.org/ - Product
References () https://www.vulncheck.com/advisories/panda3d-deploy-stub-stack-exhaustion-via-unbounded-alloca - () https://www.vulncheck.com/advisories/panda3d-deploy-stub-stack-exhaustion-via-unbounded-alloca - Third Party Advisory
CPE cpe:2.3:a:cmu:panda3d:*:*:*:*:*:*:*:*
First Time Cmu
Cmu panda3d
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-908

07 Jan 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-07 21:16

Updated : 2026-06-17 10:19

NVD link : CVE-2026-22188

Mitre link : CVE-2026-22188

CVE.ORG link : CVE-2026-22188

JSON object : View

Products Affected

cmu

  • panda3d
CWE
CWE-457

Use of Uninitialized Variable

CWE-789

Memory Allocation with Excessive Size Value

CWE-908

Use of Uninitialized Resource