CVE-2026-12386— Buffer Overflow in TUBITAK BILGEM's Pardus Pen
Possible ATT&CK Techniques 2AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TUBITAK BILGEM Software Technologies Research Institute | Pardus Pen | <=4.1.5< 4.2.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12386
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Buffer Overflow in TUBITAK BILGEM's Pardus Pen
Source: CVE Program / CVE List V5
Vulnerability Description
Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This issue affects Pardus Pen: from <=4.1.5 before 4.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不恰当的空终结符
Source: CVE Program / CVE List V5
Vulnerability Title
TÜBİTAK BİLGEM Pardus Pen 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TÜBİTAK BİLGEM Pardus Pen是TÜBİTAK BİLGEM政府部门的一个电子白板与屏幕批注应用。 TÜBİTAK BİLGEM Pardus Pen存在缓冲区错误漏洞，该漏洞源于空终止处理不当，可能导致缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TUBITAK BILGEM Software Technologies Research Institute | Pardus Pen | <=4.1.5 ~ 4.2.1 | - |
II. Public POCs for CVE-2026-12386
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12386
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12386 (1)
- 🔗 T.C. Siber Güvenlik Başkanlığı - Güvenlik Bildirimleri Detaygovernment-resource
Same Patch Batch · TUBITAK BILGEM Software Technologies Research Institute · 2026-07-05 · 4 CVEs total
| CVE-2026-9085 | 8.8 HIGH | DNS Hijacking in TUBITAK BILGEM's Pardus-Parental-Control |
| CVE-2026-12250 | 7.9 HIGH | Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner |
| CVE-2026-6509 | 7.8 HIGH | Privilege Escalation in TUBITAK BILGEM's Pardus Update |
IV. Related Vulnerabilities
- CVE-2026-15599
Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-dom - CVE-2026-18915
Exposure of OTP Secret Through Process Command-Line Argument - CVE-2026-18806
Arbitrary Block Device Write via Missing Validation in TÜBİT - CVE-2026-18642
Remote Code Execution via Insecure Deserialization in TÜBİTA - CVE-2026-16287
Root Command Injection via Offline Update in TÜBİTAK BİLGEM'
Same weakness: CWE-170
- CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-n - CVE-2026-8721
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl trunca - CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in u - CVE-2026-34032
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due - CVE-2026-40334
libgphoto2 missing null termination in ptp_unpack_Canon_FE()
V. Comments for CVE-2026-12386
No comments yet