# CVE-2026-12386: TUBITAK BILGEM Pardus Pen buffer overflow via improper null termination

Source: https://junglewise.ai/threats/cve-2026-12386-tubitak-bilgem-pardus-pen-buffer-overflow-via-improper-null  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-12386 · Severity: low · CVSS 3.9 · Published 2026-07-05

Pardus Pen, a tool developed by the TUBITAK BILGEM Software Technologies Research Institute, contains a security flaw in how it handles data strings. An attacker with local access to a system could exploit this to cause the application to crash or potentially access restricted information. This could lead to minor service disruptions or limited data exposure for users of the affected software.

Vendors: [TUBITAK BILGEM Software Technologies Research Institute](https://junglewise.ai/threats/vendors/tubitak-bilgem-software-technologies-research-institute).

## Quick answers

**Is CVE-2026-12386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12386 being exploited in the wild.

**How severe is CVE-2026-12386?** Low severity, with a CVSS score of 3.9, published 5 July 2026.

**Which products and versions are affected?** TUBITAK BILGEM Software Technologies Research Institute Pen <=4.1.5 before 4.2.1.

**Is there a fix for CVE-2026-12386?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12386 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-12386?** Check whether you run TUBITAK BILGEM Software Technologies Research Institute Pen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-170 (Improper Null Termination) exists in Pardus Pen versions <=4.1.5. The software fails to properly terminate strings with a null character, which can lead to a buffer overflow when the data is subsequently processed. An attacker with local access and low privileges could exploit this flaw, though it requires some level of user interaction. Successful exploitation could result in a denial-of-service (application crash) or limited information disclosure. The issue is addressed in version 4.2.1.

## Affected products

- TUBITAK BILGEM Software Technologies Research Institute Pardus Pen <=4.1.5 before 4.2.1

## Timeline

- 2026-07-05: advisory: CVE published by NVD and TR-CERT
- 2026-07-05: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0499](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0499)