Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-22188 EUVD-2026-1164GHSA-xvxx-4fr3-55xv

Panda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()

Published Jan 7, 2026 · Updated Jul 14, 2026 · Assigned by VulnCheck

Description

The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.

Affected products

VendorProductAffectedFixed
Panda3D Panda3D ≤ 1.10.16 —

References