PEAK-System PCAN Driver CVE-2026-109576

Requires local access to a Windows host running the PEAK-System PCAN / PEAK device driver setup, with at least low (PR:L) privileges to submit CAN record data to the driver's record-list parser; no user interaction is needed (UI:N). The specific trigger is supplying a record list containing a record that the parser correctly flags as malformed - the bug is that the loop still advances its processed-bytes counter for the rejected record, desynchronizing subsequent parsing and leading to an out-of-bounds write. Limiting factors: the attack vector is local only (no remote/network exploitation), it requires an authenticated low-privilege context on the machine, and the realistic impact is availability loss (driver/system crash) rather than code execution or data compromise.

This is a moderate-severity, locally-exploitable availability issue rather than a high-priority remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) tells a consistent story: an attacker needs local access and at least low privileges, the attack is low-complexity, and the only impact is availability (C:N/I:N) - i.e. a denial of service, most plausibly a driver crash/system hang from the out-of-bounds condition (CWE-787). No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' The one notable tension is between the metadata tags ('Buffer Overflow', 'Memory Corruption') and the CVSS impact set, which shows C:N/I:N/A:H - a classic memory-safety bug that, as scored, yields only a crash rather than code execution or data disclosure. If reliable arbitrary code execution were demonstrated, the integrity/confidentiality metrics would be expected to rise; as presented, treat this as a local DoS. Net: real but low-urgency, appropriate for routine patching rather than emergency response, especially given the local attack vector.

A local, low-privileged user (or malicious software already running on the host) feeds a crafted sequence of CAN records containing a malformed/invalid record to the PEAK-System PCAN driver. Because the record-list loop advances its processed-bytes counter even after rejecting the invalid record, parsing desynchronizes and the driver performs an out-of-bounds write (CWE-787), crashing the driver or the host for a denial of service. No public exploit was identified in the provided data, and the local vector plus low-privilege requirement limits this to attackers who already have a foothold on the machine.