CVE-2026-109576

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: ICS-CERT

Description

The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-109576

Affected Vendors & Products

Vendor	Product	Version / Range
HMS Networks	PEAK-System Device Driver Setup	0
HMS Networks	PCAN Windows CAN device drivers	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

The vulnerability involves a parser in the PEAK-System PCAN driver that incorrectly handled malformed records. The loop processing these records advanced the byte counter even when a record was rejected as invalid, potentially leading to incorrect parsing or buffer overflows.

Detection Guidance

This vulnerability involves a loop counter issue in the PEAK-System PCAN driver's parser that incorrectly advances even when invalid records are detected. Detection would require inspecting driver logs for malformed CAN record handling or unusual loop counter behavior during CAN bus communication.

Impact Analysis

This flaw could cause denial-of-service conditions or system crashes by corrupting memory or triggering infinite loops. It may also allow unauthorized access if exploited to manipulate CAN bus communications.

Compliance Impact

The vulnerability involves improper handling of malformed records in the PEAK-System PCAN driver, leading to potential denial of service due to excessive processing. This could indirectly impact compliance by disrupting system availability, which may violate availability requirements in standards like GDPR or HIPAA.

Mitigation Strategies

Update the PEAK-System PCAN driver to the latest version provided by HMS Networks to address the malformed record handling issue.

Hi! I’m here to help you understand CVE-2026-109576. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...