CVE-2026-101103

Awaiting Analysis Awaiting Analysis - Queue

PECAN Diagnostic Call Buffer Overflow

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: ICS-CERT

Description

The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101103

Affected Vendors & Products

Vendor	Product	Version / Range
HMS Networks	PEAK-System Device Driver Setup	0
HMS Networks	PCAN Windows CAN device drivers	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

The PEAK-System PCAN diagnostic call has a vulnerability where it fails to check if the output buffer provided by the caller is large enough to store the output record. This could lead to buffer overflow issues if the buffer is too small.

Detection Guidance

This vulnerability involves insufficient validation of an output buffer in the PEAK-System PCAN diagnostic call. Detection requires checking for buffer overflow conditions in the PCAN device drivers or related software. No specific commands are provided in the context to detect this issue directly.

Impact Analysis

This vulnerability may allow an attacker with local access to cause a denial of service or execute arbitrary code by exploiting the buffer overflow. It could crash the system or enable unauthorized actions on the device.

Compliance Impact

The vulnerability involves a buffer overflow risk due to insufficient validation of the output buffer size in the PEAK-System PCAN diagnostic call. This could potentially lead to memory corruption or crashes, but there is no direct evidence in the provided context that this vulnerability specifically impacts compliance with GDPR or HIPAA.

Mitigation Strategies

Update the PEAK-System PCAN diagnostic driver to the latest version provided by HMS Networks to ensure proper buffer validation.

Hi! I’m here to help you understand CVE-2026-101103. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...