HMS Networks PEAK-System PCAN Windows drivers: 6 CVEs, High 7.1
Summary
CISA reports 6 vulnerabilities in HMS Networks PEAK-System Device Driver Setup, PCAN Windows CAN device drivers. Weakness types: Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Validation of Array Index (+2 more). Successful exploitation of these vulnerabilities could crash the Windows kernel. Highest CVSS v3 score: 7.1 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- HMS Networks
- Products
- PEAK-System Device Driver Setup, PCAN Windows CAN device drivers
- CVEs
- CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, CVE-2026-105960
- Highest CVSS v3
- 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Transportation Systems, Healthcare and Public Health, Energy, Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Sweden
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-109576 | Out-of-bounds Write | 5.5 | – | No | The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid. |
| CVE-2026-101103 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 5.5 | – | No | The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. |
| CVE-2026-94188 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 5.5 | – | No | The copied source field in PEAK-System PCAN is attacker-influenced through the related file-device write path, and the caller can combine a small output allocation with controlled source bytes. |
| CVE-2026-103672 | Improper Validation of Array Index | 7.1 | – | No | The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. |
| CVE-2026-110322 | Untrusted Pointer Dereference | 5.5 | – | No | The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing. |
| CVE-2026-105960 | Improper Handling of Length Parameter Inconsistency | 5.5 | – | No | PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. |
Affected products (2)
- HMS Networks PEAK-System Device Driver Setup: <=5.1.2.1151
- HMS Networks PCAN Windows CAN device drivers: <=5.1.2
Vendor fixes and mitigations (from advisory)
- Mitigation: HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. link
- Mitigation: For more information see the associated HMS security advisory. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.