CVE-2026-22190

CVE-2026-22190 is an uncontrolled format string vulnerability affecting Panda3D versions up to and including 1.10.16. Specifically, the egg-mkfont utility improperly uses the -gp command-line option directly as a format string for sprintf(), allowing an attacker to inject format specifiers. This vulnerability carries a CVSS score of 7.5 (High), indicating that an unauthenticated attacker can remotely exploit it with low complexity to disclose sensitive stack-resident memory and pointer values. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.