Memory Management Issue in PEAK-System PCAN Driver
CVE-2026-105960

6.8MEDIUM

Key Information:

Vendor

Hms Networks

Status
Peak-system Device Driver Setup
Pcan Windows Can Device Drivers
Vendor
CVE Published:
20 October 2026

What is CVE-2026-105960?

PEAK-System's PCAN driver has a vulnerability related to improper management of variable-length receive-record copies. The driver fails to adequately limit the number of queued records based on the output length provided by callers. This oversight can potentially lead to excessive memory usage and disrupt normal operations, posing a risk to system stability. It is crucial for users to apply the recommended updates and follow security advisories to mitigate any potential impact.

Affected Version(s)

PCAN Windows CAN device drivers 0 <= 5.1.2

PEAK-System Device Driver Setup 0 <= 5.1.2.1151

PCAN Windows CAN device drivers 5.1.4

References

https://www.hms-networks.com/cybersecurity
https://www.peak-system.com/support/downloads/software/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seyeon Bang reported this vulnerability to CISA.
.