Panda3D versions up to and including 1.10.16 contain an uncontrolled format string vulnerability in the egg‑mkfont tool. The –gp (glyph pattern) command‑line option is fed directly as a format string to sprintf() with only a single supplied argument. An attacker can embed additional format specifiers, causing egg‑mkfont to read stack values and write the resulting output into generated .egg and .png files, thereby disclosing memory contents and pointer values.

Affected by the vulnerability are installations of Panda3D version 1.10.16 or earlier. The issue is tied to the egg‑mkfont utility within the Panda3D distribution and can affect any platform where the distribution is installed, such as Windows, macOS, or Linux.

The CVSS score is 5.1, indicating moderate severity, and the EPSS score is less than 1 %, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local attacker who has the ability to execute the egg‑mkfont command. By crafting a malicious –gp argument, the attacker can read sensitive information from the stack and have it written into output files, exposing confidential data to anyone with access to those files. No remotely exploitable conditions are described in the advisory.