UYAP Document Editor: Deserialization of untrusted data (object injection)

Summary

The UYAP Document Editor, a desktop application used for judicial documents in Turkey, contains a deserialization flaw (CWE-502) that allows object injection. An attacker who gets a user to open a crafted document could affect the confidentiality, integrity and availability of the system. The CVSS score is 8.8, but the attack path is not described by the vendor, and the CNA's description of remote code execution is not confirmed by the CVE text itself.

Affected

• Windows and Linux: before 5.4.20
• macOS: before 5.4.21

Fixed in

• Windows and Linux: 5.4.20 or later
• macOS: 5.4.21 or later

Workaround

• No vendor workaround published.
• Unknown.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no.
• Public proof of concept: not confirmed.

Our recommendation

• If UYAP Document Editor is installed, update to 5.4.20 (Windows/Linux) or 5.4.21 (macOS). Also apply the fix for CVE-2026-18390 in the same update.
• Until patched, only open UDF files from trusted sources.
• Check whether any client or staff member uses UYAP, especially for Turkish legal matters.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• TR-CERT advisory TR-26-1299 (Siber Güvenlik Başkanlığı) siberguvenlik.gov.tr
• UYAP Editor download page (official) uyap.gov.tr
• VulDB entry 416942 vuldb.com
• OpenCVE CVE-2026-12613 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:28.