Pardus Software EUVD-2026-41552

Exploitation requires local access to a system running pardus-software version 1.0.4 or earlier (the Pardus software center) and a low-privileged authenticated account (CVSS PR:L), with no user interaction needed. The concrete prerequisite is reaching the privileged pardus-software operation that is missing its authorization check and passing crafted input into the argument-injection sink that feeds the underlying privileged package/command backend. What limits exploitation: the attacker must already be a local user or have local code execution (AV:L) - there is no remote or network path - and the affected host must be running a vulnerable pre-1.0.5 version; systems already on 1.0.5 or without the pardus-software component installed are not exposed.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) describes a local, low-complexity attack requiring only low privileges and no user interaction, with a scope change and full High impact across confidentiality, integrity, and availability - the classic signature of local privilege escalation to root. The most important limiting factor is AV:L: the attacker must already have a local account or code-execution foothold on the host, so this is not a remotely exploitable, internet-facing flaw. There is no EPSS score, no KEV listing, and no POC referenced in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is driven by the impact profile rather than by demonstrated in-the-wild abuse. No SSVC decision data was supplied. Net assessment: a genuine high-severity local escalation worth prompt patching on multi-user or shared Pardus systems, but lower urgency than a remote unauthenticated flaw given the local-access precondition.

A low-privileged user with a local shell on a Pardus workstation invokes the pardus-software backend operation that lacks an authorization check and supplies crafted input that is passed through as extra command-line arguments to the privileged package-management helper. Because the scope changes and impact is High across the board, the injected arguments cause the privileged process to execute attacker-chosen actions, escalating the user to root-level control of the machine. No public POC is currently identified, but the low complexity and lack of required user interaction make development straightforward for an attacker with local access.