EUVD-2026-105316
GHSA-cw79-5c2h-gpr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege access
-
DeliveryInvoke PCAN diagnostic call
-
ExploitSupply undersized output buffer
-
ExecutionTrigger buffer overflow in driver
-
ImpactCrash driver/service (availability loss)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to invoke the PEAK-System PCAN diagnostic call locally on a Windows system that has the PCAN CAN device drivers (or PEAK-System Device Driver Setup) installed, and the attacker must supply an output buffer smaller than the diagnostic output record the driver writes. Limiting factors: the attack vector is local (AV:L) and requires existing privileges to reach the driver interface (PR:L), there is no network reachability, and impact is confined to availability (driver/service crash) with no disclosed path to code execution, data disclosure, or integrity loss in the provided description. |
| Impact | This is a moderate-severity, locally-exploitable availability flaw rather than a high-priority remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent: exploitation requires local access and some existing privileges (PR:L), carries no confidentiality or integrity impact, and results only in an availability loss - consistent with CWE-120 (classic buffer overflow) where an undersized caller-supplied output buffer leads to a memory corruption that most plausibly crashes the component. No EPSS score, SSVC decision data, KEV listing, or POC was supplied in the input. Because KEV status is absent, exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between signals here - all available data points the same direction (local, privilege-dependent, DoS-only). The main limiter is the local attack vector: an attacker must already be able to invoke the PCAN diagnostic call on the host, which substantially reduces real-world urgency compared to a network-reachable CWE-120. Treat this as a routine-patch item for affected PEAK-System/PCAN Windows driver deployments, not an emergency. |
| Exploit ScenarioDerived | A local user (or malicious/low-privilege process) on a Windows host running the PCAN CAN device drivers invokes the diagnostic call while supplying an output buffer smaller than the output record the driver writes. The driver fails to validate the buffer size and overflows it, corrupting memory and crashing the driver or dependent service (availability loss). No public exploit code was identified in the provided data, and the local, privilege-requiring nature (AV:L/PR:L) means this is not remotely triggerable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
PEAK-System PCAN Windows CAN device drivers and the PEAK-System Device Driver Setup package contain an output-buffer validation flaw in the PCAN diagnostic call, where the driver writes its diagnostic output record without confirming the caller-supplied buffer is large enough. A local user with existing privileges who can reach the driver interface and supplies an undersized buffer can trigger memory corruption that crashes the driver or service, degrading availability; there is no disclosed path to code execution, data disclosure, or integrity loss. The CISA ICS advisory (ICSA-26-293-01) covers this issue, no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw carries a moderate EPSS-style risk profile given its local attack vector and privileges required.
RemediationAI
Apply the corrected PEAK-System PCAN Windows device driver release from PEAK-System's software download page (https://www.peak-system.com/support/downloads/software/) and re-verify the installed driver version, cross-checking against the vendor advisory referenced in CISA ICSA-26-293-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01) and HMS Networks' security page (https://www.hms-networks.com/cybersecurity); the supplied CPE strings are wildcarded, so confirm the specific fixed build with the vendor rather than assuming a version number. Where immediate update is not possible, compensating controls should focus on the local privilege prerequisite: remove local interactive logon and debug-level access for non-administrative users on engineering workstations hosting PCAN drivers, and restrict who may load or interact with the PCAN diagnostic interface (for example by keeping non-operators off the host entirely, or running CAN tooling under a dedicated low-privilege account that cannot open the driver's diagnostic device object). The trade-off is reduced flexibility for field engineers and test technicians who rely on local diagnostic tooling. Additionally, isolate affected engineering workstations from general-purpose user activity and ensure crash dumps are collected and monitored so that a driver crash caused by an undersized diagnostic buffer is detected; this does not remove the flaw and only limits blast radius. Reboot after driver installation, and validate that the updated driver is loaded by checking the installed driver version post-upgrade, since stale driver packages can persist through the Device Driver Setup installer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-120, classic buffer copy without size checking, in the PCAN diagnostic call exposed by PEAK-System's Windows CAN device driver stack. The diagnostic routine accepts a caller-supplied output buffer pointer and length, but the driver does not verify that the buffer is at least as large as the fixed diagnostic output record it intends to copy back, resulting in an out-of-bounds write when a smaller buffer is passed. Per the CPE data, the affected components are the PEAK-System Device Driver Setup and PCAN Windows CAN device drivers distributed by HMS Networks/PEAK-System; the hardware/driver boundary means the vulnerable interface is reached through local device I/O rather than any network socket. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a local, low-complexity attack requiring existing low privileges and no user interaction, with impact limited to availability; scope is unchanged and there is no confidentiality or integrity effect described. Because the record copy is driven by kernel/driver-side logic, a successful trigger corrupts memory in the driver context, typically surfacing as a system crash or blue screen rather than a controlled fault, but nothing in the advisory indicates that the overflow is reachable with attacker-controlled data that would enable escalation.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local invocation of a driver diagnostic call by a privileged caller gives AV:L/PR:L; missing buffer-size validation reliably overflows, so AC:L, and the described effect is a crash, so A:H only.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB