What is the CVSS score of CVE-2026-12386?

CVE-2026-12386 has a CVSS 3.1 base score of 3.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-12386?

Yes, a patch is available for CVE-2026-12386. Update the affected software to the latest version immediately.

Pardus Pen CVE-2026-12386

Q: Which versions of Pardus Pen are affected by CVE-2026-12386?

Buffer overflow via improper null termination in Pardus Pen affects versions up to and including 4.1.5, with a fix available in 4.2.1.. A patch is available.

EUVD-2026-41764 LOW

Improper Null Termination (CWE-170)

2026-07-05 TR-CERT

GHSA-hmmj-28g4-h22x

Buffer Overflow Pardus Pen Tubitak Bilgem Software Technologies Research Institute

3.9

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

3.9 LOW

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

3.9 LOW

Local vector confirmed by description; low privilege and required user interaction match overflow trigger; no integrity impact applies; scope unchanged per application boundary.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 05, 2026 - 16:01 EUVD

Analysis Generated

Jul 05, 2026 - 15:26 vuln.today

DescriptionCVE.org

Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers.

This issue affects Pardus Pen: from <=4.1.5 before 4.2.1.

AnalysisAI

Buffer overflow via improper null termination in Pardus Pen affects versions up to and including 4.1.5, with a fix available in 4.2.1. A local, low-privileged user who interacts with crafted input can trigger a CWE-170 null termination error causing out-of-bounds memory reads, resulting in limited confidentiality exposure and availability disruption. No public exploit code and no CISA KEV listing are associated with this CVE; the vulnerability was disclosed by TR-CERT (Turkey's national CERT) and carries a low CVSS base score of 3.9.

Technical ContextAI

Pardus Pen is a stylus and pen-input utility developed by TUBITAK BILGEM Software Technologies Research Institute (Turkey's national cybersecurity and software research body) for the Pardus Linux distribution. The flaw is classified as CWE-170 (Improper Null Termination), a root cause where a string or buffer is not correctly terminated with a null byte, allowing subsequent string operations to read or write beyond the intended boundary. This leads to an overflow condition that can corrupt adjacent memory, leak limited data, or cause a crash. The CPE string cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus_pen:*:*:*:*:*:*:*:* confirms the affected product is the application-layer Pardus Pen software, not an OS-kernel component, which constrains the blast radius to the application's memory space given the unchanged scope (S:U) in the CVSS vector.

RemediationAI

Upgrade Pardus Pen to version 4.2.1 or later, which resolves the improper null termination flaw. The patch is confirmed by the vendor advisory published at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0499 by TR-CERT. If an immediate upgrade is not feasible, restrict local user access to the application to only trusted accounts, reducing the PR:L attack surface. Additionally, monitor the application for unexpected crashes that may indicate exploitation attempts; note that this logging approach may produce noise in environments with legitimate high-volume pen-input usage. There are no known workarounds that fully mitigate the null termination flaw short of patching.