Pardus Pen CVE-2026-12386

Exploitation requires a local session on the target system (AV:L) with at least low-privileged account access (PR:L). The victim user or the attacker must actively interact with the application or a crafted input to trigger the null termination flaw (UI:R). The application must be running and processing pen or stylus input data. The vulnerability is limited to Pardus Pen versions 4.1.5 and below; systems running version 4.2.1 or later are not affected. Exploitation is further constrained by unchanged scope (S:U), meaning the overflow cannot pivot beyond the application process boundary to compromise the broader OS. No authentication bypass or remote vector has been identified.

The overall real-world risk is low. The CVSS 3.1 base score of 3.9 is consistent with the vector breakdown: local attack vector (AV:L) eliminates remote exploitation, low privileges are required (PR:L), and user interaction is needed (UI:R), all of which significantly limit opportunistic or automated exploitation. Impact is confined to partial confidentiality loss (C:L) and limited availability disruption (A:L) with no integrity impact (I:N) and unchanged scope (S:U). No EPSS data was provided in the intelligence package, so probability of exploitation in the wild cannot be quantified. There is no KEV listing and no public POC identified at time of analysis. The absence of a published proof-of-concept and the niche deployment footprint of Pardus Pen (a Turkish national Linux distribution utility) further reduce practical risk. SSVC signals suggest 'Track' disposition rather than immediate emergency response: exploitation requires physical or session-level local access, is not automatable at scale, and technical impact is partial at most.

A low-privileged local user on a Pardus Linux system with Pardus Pen installed crafts a malformed input - such as a file or data stream lacking proper null termination - and triggers its processing through normal application interaction. The null termination error causes a buffer overflow, potentially leaking a small amount of adjacent memory content and crashing the application. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) suggests the overflow is reproducible once the triggering input structure is understood.