PEAK-System PCAN CVE-2026-103672

Exploitation requires the ability to deliver a crafted record to the PEAK-System PCAN parser on a host where the affected PEAK-System Device Driver Setup or PCAN Windows CAN device drivers are installed; the triggering condition is a record whose DLC field is greater than 0x0f, which bypasses the missing DLC <= 0x0f bound check and drives an out-of-bounds length-table index and overflow of the fixed-size stack destination copied from record+0x1c. Limiting factors per the CVSS vector: the attack is LOCAL (AV:L), requires low privileges on the host (PR:L), and needs no user interaction (UI:N); it does not expose data (C:N) but can corrupt integrity and availability (I:H/A:H). Realistic risk is therefore bounded to attackers who already have local low-privileged execution on a system with these drivers installed.

This is a genuine memory-corruption flaw (CWE-129 improper array index validation leading to a stack buffer overflow): the PCAN parser uses an attacker-controlled DLC to index a length table without enforcing DLC <= 0x0f, then copies payload from record+0x1c into a fixed-size stack destination. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 7.1) signals a LOCAL, low-complexity, low-privilege attack with high integrity and availability impact but NO confidentiality impact - consistent with a write-based stack overflow rather than data leakage. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent (local vector matches a driver/parser that processes records on the host; C:N matches a non-disclosure overflow), so this is a real but local-scope priority rather than an internet-wide emergency. CONFLICT TO NOTE: the input Tags include 'Information Disclosure', which contradicts the CVSS (C:N, no confidentiality impact) and the overflow mechanism - treat the tag as likely mislabeled. Because the vector is AV:L and requires PR:L, real-world risk is bounded by the need for prior local low-privileged access to the affected host.

A local, low-privileged attacker on a Windows host running the PEAK-System/PCAN CAN drivers supplies a crafted record whose DLC field exceeds 0x0f. The parser indexes its length table with the oversized DLC and copies the attacker payload from record+0x1c into a fixed-size stack buffer, overflowing it and corrupting the stack to crash the driver or potentially alter control flow. No public exploit code is referenced, and exploitation requires local access rather than a remote/network path.