CVE-2026-22188

The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled argc value without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.

• CWE-457
• CWE-789
• CWE-908

• https://github.com/panda3d/panda3dProduct
• https://seclists.org/fulldisclosure/2026/Jan/9Exploit, Mailing List, Third Party Advisory
• https://www.panda3d.org/Product
• https://www.vulncheck.com/advisories/panda3d-deploy-stub-stack-exhaustion-via-unbounded-allocaThird Party Advisory

Published

Jan 7, 2026

Last Modified

Jul 14, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22182wpDiscuz before 7.6.47 contains an unauthenticated denial of…8.7
• CVE-2026-22183wpDiscuz before 7.6.47 contains a stored cross-site scriptin…5.4
• CVE-2026-22184zlib versions up to and including 1.3.1.2 include a global b…7.8
• CVE-2026-22185OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up…4.6
• CVE-2026-22186Bio-Formats versions up to and including 8.3.0 contain an XM…7.1
• CVE-2026-22187Bio-Formats versions up to and including 8.3.0 perform unsaf…7.8
• CVE-2026-22189The egg-mkfont utility in Panda3D versions up to and includi…9.8
• CVE-2026-2219It was discovered that dpkg-deb (a component of dpkg, the De…7.5
• CVE-2026-22190The egg-mkfont utility in Panda3D versions up to and includi…7.5
• CVE-2026-22191Beghelli Sicuro24 SicuroWeb contains a template injection vu…5.2
• CVE-2026-22192Voltronic Power SNMP Web Pro version 1.1 contains an authent…9.9
• CVE-2026-22193wpDiscuz before 7.6.47 contains an SQL injection vulnerabili…7.5