Pardus Pen CVE-2026-11765

Exploitation requires an interactive local session with at least low-privilege (standard user) account access on a system running Pardus Pen before 4.2.1. The attacker must be able to provide crafted input to the application's command-construction path. The CVSS AV:L metric confirms strictly local exploitation with no network-accessible vector. No specific non-default configuration is described as a prerequisite; however, exploitation is inherently limited to environments where Pardus Pen is installed, which is specific to the Pardus Linux ecosystem, predominantly deployed in Turkish government and educational institutions.

The CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures a genuinely low-severity issue. Exploitation is bounded to an authenticated local session with standard user privileges, sharply constraining the attacker population to users who already have shell access on the target system. The integrity impact is rated Low, consistent with argument injection that can redirect or augment command behavior without delivering arbitrary code execution based on the available data-there is no scope change and no confidentiality or availability impact. No EPSS score is supplied in the input; KEV status is absent, confirming no known active exploitation. SSVC signals: exploitation = none, automatable = no (local access prerequisite), technical impact = partial. This is a real but low-priority vulnerability, most relevant to Pardus Linux deployments in multi-user or shared environments where user privilege separation is security-sensitive.

A local user with a standard (low-privilege) account on a Pardus Linux system running Pardus Pen before 4.2.1 crafts input containing unescaped argument delimiters-such as embedded spaces or special characters-that are passed unsanitized to an underlying command invocation within the application. The injected arguments modify the command's behavior, allowing limited unauthorized alteration of data or program state beyond what the application intended. No public exploit code has been identified at time of analysis.