TI-2026-85395 Aliases CVE-2026-95652 GHSA-2w45-vhrc-j6gv

Excess privileges in pardus-usb-formatter let users format disks

LOW 28CWE-250Published 2026-11-05 · Updated 2026-11-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

TÜBİTAK BİLGEM pardus-usb-formatter from 0.7.0 before 0.7.2 runs with unnecessary privileges (CWE-250). Improper device validation lets the privileged tool format disks. A local user with low privileges can exploit this when another user interacts with the tool, with high impact to integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse. This issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0014 3rd percentileScored 2026-11-07

Fix Fixed pardus-usb-formatter (TÜBİTAK BİLGEM Software Technologies Research Institute): 0.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TÜBİTAK BİLGEM Software Technologies Research Institute	pardus-usb-formatter	0.7.0 to before 0.7.2	0.7.2	Patch available	CNA

pardus-usb-formatter VendorTÜBİTAK BİLGEM Software Technologies Research Institute Affected 0.7.0 to before 0.7.2 Fixed in 0.7.2 Patch available CNA

Remediation

Update pardus-usb-formatter to version 0.7.2, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fix · CNA pardus-usb-formatter (TÜBİTAK BİLGEM Software Technologies Research Institute) Fixed in 0.7.2

Timeline

2026-11-05 Threatist record created from CVE-2026-95652
2026-11-05 Alias added: GHSA-2w45-vhrc-j6gv
2026-11-05 CISA SSVC decision points changed
2026-11-05 Priority changed: MEDIUM → LOW

References

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1466

TI-2026-53129 Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk CVSS 3.1CRITICAL 9.1
TI-2026-15720 Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk CVSS 3.1HIGH 7.5
TI-2026-15985 OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair CVSS 3.1HIGH 7.8
TI-2026-83798 Privilege escalation in TÜBİTAK BİLGEM eta-register CVSS 3.1HIGH 7.8
TI-2026-55130 Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter CVSS 3.1HIGH 7.1
TI-2026-15399 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer CVSS 3.1HIGH 7.1

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences