The deploy‑stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy‑stub executable allocates argv_Copy and argv_Copy2 using alloca() based directly on the attacker‑controlled argc value without validation. Supplying a large number of command‑line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, resulting in a reliable crash and undefined behavior.

The vulnerability is present in Panda3D across all supported platforms that ship the deploy‑stub component. It affects any deployment of Panda3D version 1.10.16 or earlier, regardless of operating system, since the affected binary is included in all builds of the distribution.

The set of weaknesses that enable this vulnerability align with CWE-457, CWE-789, and CWE-908, describing reliance on dynamic stack allocation, stack overflows, and lack of bounds checking. The CVSS base score of 6.9 indicates medium impact severity, while the EPSS score of less than 1% suggests that exploitation likelihood is currently very low. The vulnerability is not listed in the CISA KEV catalog, implying no documented active exploitation has been observed. Based on the description, a likely attack vector is local command‑line manipulation, allowing an adversary controlling execution of the deploy‑stub to trigger the crash without network access or additional privileges. The consequence is a denial of service for the affected process, potentially interrupting game or simulation deployments.