Pardus Boot Repair EUVD-2026-76125

Exploitation requires a local shell account on a Pardus Linux system with the vulnerable version of Pardus Boot Repair installed (before 1.0.8). The attacker must be able to execute the boot repair tool, which likely requires either direct invocation rights or sudo access to the utility - consistent with the PR:L CVSS metric. No special configuration, network connectivity, or user interaction is needed beyond having a low-privilege local account. The attack is limited to systems running the Pardus Linux distribution with this specific utility present; it does not apply to other Linux distributions or systems where Pardus Boot Repair is not installed.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting a local attack requiring only low-privilege credentials with no user interaction and no elevated attack complexity. The real-world risk is proportionally higher than the raw CVSS might suggest for two reasons: first, boot repair utilities are very likely to run with root privileges, converting a PR:L exploit into a full root shell; second, AC:L indicates no special timing, race condition, or environmental prerequisite. No EPSS data or KEV listing is present in the input, and no public POC is identified at time of analysis, suggesting this has not yet seen widespread exploitation. The narrow deployment base (Pardus is primarily used in Turkish government and academic contexts) limits broader exposure, but any Pardus-based environment should treat this as a local privilege escalation with high urgency given the trivial complexity post-access.

A low-privileged local user on a Pardus Linux system launches the Pardus Boot Repair utility, supplying a crafted input containing shell metacharacters (e.g., semicolons, backticks, or pipe operators) in a field that is subsequently passed unsanitized to a system() or similar shell call. Since the tool runs with elevated privileges, the injected command executes as root, granting the attacker full system control. No public POC has been identified at time of analysis, but the low attack complexity makes this straightforward to exploit by anyone with a local shell account.