CVE-2026-109576Medium· 5.5▾ SunlitThe parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Last analysed / modified upstream
The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
peak-system_device_driver_setup <= 5.1.2.1151pcan_windows_can_device_drivers <= 5.1.2HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page https://www.peak-system.com/support/downloads/software/ .
For more information see the associated HMS security advisory https://www.hms-networks.com/cybersecurity .
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101103Medium· 5.5HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow
CVE-2026-103672High· 7.1HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index
CVE-2026-105960Medium· 5.5HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
CVE-2026-110322Medium· 5.5HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference
CVE-2021-22555High· 8.3A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c
CVE-2022-37903High· 7.2A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface