Panda3D releases up to version 1.10.16 contain a flaw in the deploy‑stub executable where stack memory is allocated using alloca() based on the argc value supplied by the attacker. The lack of validation on this value allows an attacker to provide a very large number of command‑line arguments, causing the stack to be exhausted. This results in a predictable crash of the deploy‑stub and can propagate uninitialized stack memory into the Python interpreter initialization, leading to undefined behavior during the runtime of the application.

The vulnerability is present in Panda3D across all supported platforms that ship the deploy‑stub component. It affects any deployment of Panda3D version 1.10.16 or earlier, regardless of operating system, since the affected binary is included in all builds of the distribution.

The set of weaknesses that enable this vulnerability align with CWE-457, CWE-789, and CWE-908, which describe reliance on dynamic stack allocation, heap or stack overflows, and lack of bounds checking. The CVSS base score of 6.9 indicates a medium impact severity, yet the EPSS score of less than 1% suggests that exploitation likelihood is currently very low. The vulnerability is not listed in the CISA KEV catalog, implying that no documented active exploitation has been observed. However, because the attack vector is local command‑line manipulation, an adversary controlling execution of the deploy‑stub can readily trigger the crash without needing network access or additional privileges. The consequence is a denial of service for the affected process, potentially leading to interruption of game or simulation deployments.