CVE-2026-105960

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in PEAK-System PCAN Driver

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: ICS-CERT

Description

PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-105960

Affected Vendors & Products

Vendor	Product	Version / Range
HMS Networks	PEAK-System Device Driver Setup	0
HMS Networks	PCAN Windows CAN device drivers	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

PEAK-System PCAN driver has a flaw where it copies receive-records without properly limiting the copy size to the caller's output buffer length. This could allow buffer overflow if the driver uses a requested record count larger than the actual output buffer.

Impact Analysis

An attacker with local access could exploit this to crash the system or execute arbitrary code with kernel privileges. This may lead to denial of service or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized data access or system compromise, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update the PEAK-System PCAN driver to the latest version provided by HMS Networks to address the variable-length receive-record copy issue.

Hi! I’m here to help you understand CVE-2026-105960. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...