CVE-2026-109576
Received
Received - Intake
PCAN Driver Malformed Record Parsing Loop Vulnerability
Vulnerability report for CVE-2026-109576, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-20
Last updated on: 2026-10-20
Assigner: ICS-CERT
Description
Description
The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| HMS | Networks | PEAK-System Device Driver Setup 0 |
| HMS | Networks | PCAN Windows CAN device drivers 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
