{"id":"CVE-2026-95652","kind":"vulnerability","aliases":["CVE-2026-95652"],"related":[],"title":"pardus-usb-formatter: unnecessary privileges let local users abuse elevated rights","description":"Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse.\n\nThis issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2.","summary":"pardus-usb-formatter, a USB formatting tool from TÜBİTAK BİLGEM, runs with more privileges than it needs. A local user can abuse those privileges to act with rights they should not have.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","pardus","usb-formatter"],"not_affected_if":["not-installed","version-0.7.2-or-later"],"how_to_check":"- Check the installed version of pardus-usb-formatter; affected releases are `0.7.0` up to but not including `0.7.2`.\n- Look for the package in the Pardus system package list.","fix":"- pardus-usb-formatter: upgrade to `0.7.2` or later","status":"open","published_at":"2026-11-05T13:17:08+00:00","first_seen_at":"2026-11-05T13:39:09+00:00","triaged_at":"2026-11-05T13:40:05+00:00","updated_at":"2026-11-05T13:40:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T13:40:05Z","model":"claude-haiku-5-5","output":{"fix":"- pardus-usb-formatter: upgrade to `0.7.2` or later","reach":"local","title":"pardus-usb-formatter: unnecessary privileges let local users abuse elevated rights","impact":"medium","summary":"pardus-usb-formatter, a USB formatting tool from TÜBİTAK BİLGEM, runs with more privileges than it needs. A local user can abuse those privileges to act with rights they should not have.","audience":"businesses","category":"package","nicknames":[],"who_cares":["pardus","linux","usb-formatter"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains privileges through the formatter's excess rights","analyst_note":"","how_to_check":"- Check the installed version of pardus-usb-formatter; affected releases are `0.7.0` up to but not including `0.7.2`.\n- Look for the package in the Pardus system package list.","plain_action":"","needs_analyst":false,"not_affected_if":["not-installed","version-0.7.2-or-later"],"who_is_affected":"Systems running pardus-usb-formatter from 0.7.0 before 0.7.2, most likely Pardus desktop installs where the USB formatting tool is present. The flaw needs a local account on the machine, so shared workstations are the main concern; machines without the package can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4229,"output_tokens":507,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-95652':15A,18A '0.7.0':81C '0.7.2':83C 'abus':10A,47B,72C 'act':51B 'affect':75C 'allow':70C 'bilgem':35B,61C 'cve':13A,16A 'elev':11A 'execut':54C 'format':31B 'formatt':4A,24B,28B,69C,79C 'institut':65C 'issu':74C 'let':7A 'linux':19B 'local':8A,44B 'need':42B 'packag':20B 'pardus':2A,21B,26B,67C,77C 'pardus-usb-formatt':1A,25B,66C,76C 'privileg':6A,39B,49B,57C,71C 'research':64C 'right':12A,53B 'run':36B 'softwar':62C 'technolog':63C 'tool':32B 'tübitak':34B,60C 'unnecessari':5A,56C 'usb':3A,23B,27B,30B,68C,78C 'usb-formatt':22B 'user':9A,45B 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Systems running pardus-usb-formatter from 0.7.0 before 0.7.2, most likely Pardus desktop installs where the USB formatting tool is present. The flaw needs a local account on the machine, so shared workstations are the main concern; machines without the package can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","medium","package","pardus","usbformatter"],"campaign_type":null,"first_public_at":"2026-11-05T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95652","severity":null,"published_at":"2026-11-05T13:17:08+00:00","modified_at":"2026-11-05T13:17:08+00:00","first_seen_at":"2026-11-05T13:39:09+00:00","fetched_at":"2026-11-05T13:39:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}