PEAK-System PCAN Drivers CVE-2026-110322

Exploitation requires local access to a Windows system running the PEAK-System PCAN Windows CAN device drivers / PEAK-System Device Driver Setup, plus at least low-level privileges (PR:L) to reach the type 0x4030 processing path; no user interaction is needed. The trigger is specifically the type 0x4030 post-processing code path where a selected/returned object pointer is dereferenced without validation. Limiting factors: the attacker must already have a local foothold with some privilege, the affected CAN driver must be installed, and the realistic outcome is a driver/system crash (availability), not remote compromise or data theft.

This is a moderate-severity, locally-exploitable availability flaw (CVSS 5.5) in the PEAK-System PCAN Windows CAN device drivers, rooted in CWE-822 (Untrusted Pointer Dereference) in the type 0x4030 processing path. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) tells a consistent, non-alarming story: an attacker needs local access and at least low privileges, and the only impact is availability (A:H) - no confidentiality or integrity loss. No EPSS score, KEV listing, or POC was supplied, so there is no evidence of active or probable exploitation; this reads as a driver-crash/DoS primitive rather than a priority internet-facing threat. NOTE A CONFLICT: the input Tag 'Information Disclosure' directly contradicts the CVSS vector's C:N (no confidentiality impact), and CWE-822 with A:H points to a crash/denial-of-service outcome, not data leakage - the tag appears mislabeled and the real impact is availability. Treat this as a low-urgency patch item for the specific population running PEAK/HMS CAN drivers, not a widespread emergency.

A local attacker with low-level privileges on a Windows host running the PCAN CAN device driver issues a crafted request that drives the type 0x4030 processing path, where a returned object pointer is dereferenced without validation. The resulting invalid dereference crashes the driver and can bring down the system or CAN communications (availability loss). No public exploit code was identified, and the CVSS local vector with required privileges (AV:L/PR:L) limits this to attackers who already have a foothold on the machine.