PEAK-System PCAN EUVD-2026-105356

Requires the PEAK-System PCAN Windows CAN device driver (or Device Driver Setup package) to be installed, and local code execution as at least a standard/low-privileged user able to open the driver device and invoke its receive-record IOCTL path. Exploitation is triggered specifically by requesting or queuing a record count larger than the caller-supplied output buffer length. Limiting factors: no remote vector (AV:L) - the attacker must already have local access; the impact is availability (driver/system crash) rather than confirmed code execution or data theft; and hosts without the PEAK driver installed are unaffected.

This is a moderate, locally-exploitable availability flaw, not a top-tier remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a local attacker with low privileges (an authenticated/standard user able to open the driver device and issue IOCTLs) who can trigger a high-impact availability condition - consistent with a kernel-mode driver crash or bugcheck from a length-mismatched record copy (CWE-130). No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or imminent exploitation: by the precision rules this is 'no public exploit identified at time of analysis.' A notable conflict exists in the data: the CVSS impact is availability-only (C:N/I:N/A:H), yet the input Tags label this 'Information Disclosure.' CWE-130 length-handling bugs can indeed cause out-of-bounds over-reads that leak adjacent kernel memory into the caller's buffer, which would plausibly justify a confidentiality impact - so either the vendor CVSS understates confidentiality or the tag is mislabeled. This should be verified with the HMS/PEAK advisory before treating it as info-disclosure. Overall: prioritize as a routine local-DoS driver patch, elevated only on multi-user or shared engineering hosts; it is not a drop-everything network-exploitable issue.

A local user (or malware already running with standard privileges) on a Windows host with the PEAK-System PCAN CAN driver installed opens the driver device and issues a receive-record request specifying a record count larger than the output buffer it supplied. The driver copies based on the requested/queued count rather than capping to the caller buffer, corrupting kernel memory and crashing the system (and potentially over-reading adjacent memory). No public exploit code is known at the time of analysis.