PCAN Windows drivers through 5.1.2 can crash the kernel
Original title: HMS Networks PEAK-System PCAN Windows drivers
Six local flaws are fixed in version 5.1.4; CISA lists medium CVSS scores and no exploitation status.
CISA's ICS advisory says flaws in HMS Networks PEAK-System PCAN Windows drivers could crash the Windows kernel. Affected releases are PEAK-System Device Driver Setup 5.1.2.1151 and earlier and PCAN Windows CAN device drivers 5.1.2 and earlier. Named issues include out-of-bounds write, classic buffer overflow, bad array-index checks, untrusted pointer dereference, and length-parameter handling. HMS Networks addressed the issues in version 5.1.4 and tells users to upgrade. Reported CVSS v3.1 scores for the detailed flaws are 5.5 medium.
Unconfirmed: The advisory does not say whether any of the flaws are exploited.
- CVEs named: CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, and CVE-2026-105960.
- Vendor equipment CVSS v3 score listed as 7.1; detailed flaw scores are 5.5.
- Sectors cited include transportation, healthcare, energy, and critical manufacturing.
- HMS Networks is headquartered in Sweden; deployment is described as worldwide.
Impact: Local attacker can crash the Windows kernel
| Product | Affected | Fixed in |
|---|---|---|
| HMS Networks PEAK-System Device Driver Setup | <=5.1.2.1151 | 5.1.4 |
| HMS Networks PCAN Windows CAN device drivers | <=5.1.2 | 5.1.4 |
- 1.Upgrade PEAK-System PCAN drivers to version 5.1.4 or the newest available release.
- 2.See the associated HMS security advisory for further detail.
- Vendors
- HMS Networks
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101103 | The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record | 6.8 | — | ||
| CVE-2026-103672 | The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c… | 6.9 | — | ||
| CVE-2026-105960 | PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy | 6.8 | — | ||
| CVE-2026-109576 | The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even… | 6.8 | — | ||
| CVE-2026-110322 | The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing | 6.8 | — | ||
| CVE-2026-94188 | — | — | — |
From the original article
12 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could crash the Windows kernel. The following versions of HMS Networks PEAK-System PCAN Windows drivers are affected: PEAK-System Device Driver Setup <=5. 1.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.