PSS SINCAL WibuKey flaw can crash systems (CVE-2026-84854)
Original title: Siemens PSS(R)SINCAL
Only legacy WibuKey dongle licensing is affected; V22.5 is fixed in Update 5, while V21.5 and V22.0 need a manual runtime install.
Siemens PSS SINCAL uses the third-party WibuKey product, whose driver can write outside a kernel buffer and crash the system. CVE-2026-84854 is scored CVSS 7 HIGH and applies only when the legacy WibuKey dongle license is configured. V21.5 and V22.0 have no product fix; operators should install WibuKey Runtime for Windows 6.72 or later. V22.5 before Update 5 should move to V22.5 Update 5 or later.
Unconfirmed: No exploitation is described; whether adjacent memory changes are practical is not confirmed.
- Affected ranges are V21.5, V22.0, and V22.5 before 22.5.5.
- Adjacent kernel memory may be modified under unfavorable circumstances.
- Siemens ProductCERT reported the issue to CISA as SSA-148322.
- CWE-787 is the listed weakness.
Impact: Kernel out-of-bounds write can crash the host
| Product | Affected | Fixed in |
|---|---|---|
| Siemens PSS SINCAL | V21.5 all; V22.0 all; V22.5 before 22.5.5 | V22.5 Update 5 or later |
| WIBU Systems WibuKey | legacy dongle driver used by affected PSS SINCAL | WibuKey Runtime for Windows 6.72 or later |
- 1.Update PSS SINCAL V22.5 to Update 5 or later.
- 2.On V21.5 and V22.0, install WibuKey Runtime for Windows 6.72 or later.
- CVEs
- CVE-2026-84854
- Vendors
- SiemensWIBU Systems
- Products
- PSS SINCALWibuKey
- Organizations
- CISASiemens ProductCERT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84854 | Out-of-bounds kernel buffer write in WibuKey Windows driver before 6.72 | 7.0 | — |
From the original article
4 min read at cisa.govView CSAF Summary PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.