Peak System Device Driver Setup
Monthly
Local denial-of-service in PEAK-System PCAN Windows CAN device drivers and Device Driver Setup packages allows a low-privileged local user who can open the driver device to supply a receive-record count exceeding the caller-supplied output buffer length, causing an insufficiently bounded copy and potentially crashing the driver or system. The flaw is local only (AV:L) and affects Windows hosts with the PEAK PCAN driver installed; no public exploit was identified at time of analysis, and the assessed impact is availability only, with no confirmed confidentiality or integrity impact.
Locally exploitable denial-of-service in PEAK-System PCAN Windows CAN device drivers can crash the driver or system when a crafted type 0x4030 processing path selects or returns an object pointer that is dereferenced without validation. Affected systems are Windows hosts running the PEAK-System PCAN Windows CAN device drivers or PEAK-System Device Driver Setup, and exploitation requires local access plus low-level privileges (CVSS 5.5, AV:L/PR:L/UI:N, A:H). No public exploit was identified at time of analysis and no KEV confirmation is present in the provided data; the expected impact is availability loss, not remote compromise or confirmed data theft.
Memory corruption in the PEAK-System PCAN Windows CAN device drivers allows local low-privileged attackers to overflow a fixed-size stack buffer by delivering a crafted record whose DLC field exceeds 0x0f, which the parser uses unchecked to index a length table before copying attacker-controlled data from record+0x1c. Exploitation gives high integrity and availability impact (arbitrary stack memory corruption, likely crash or controlled writes) but no confidentiality impact, and it requires local access with low privileges and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
PEAK-System PCAN Windows CAN device drivers and the PEAK-System Device Driver Setup package contain an output-buffer validation flaw in the PCAN diagnostic call, where the driver writes its diagnostic output record without confirming the caller-supplied buffer is large enough. A local user with existing privileges who can reach the driver interface and supplies an undersized buffer can trigger memory corruption that crashes the driver or service, degrading availability; there is no disclosed path to code execution, data disclosure, or integrity loss. The CISA ICS advisory (ICSA-26-293-01) covers this issue, no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw carries a moderate EPSS-style risk profile given its local attack vector and privileges required.
Local denial of service in the PEAK-System PCAN Windows CAN device driver can be triggered when a record list contains a malformed record: although the parser rejects the record, the processing loop still advances its processed-bytes counter, desynchronizing parsing and producing an out-of-bounds write (CWE-787). The issue affects PEAK-System Device Driver Setup and PCAN Windows CAN device drivers distributed through HMS Networks, and exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis, and there is no CISA KEV confirmation; the assessed impact is availability loss, such as a driver or system crash, rather than code execution or data compromise.
Local denial-of-service in PEAK-System PCAN Windows CAN device drivers and Device Driver Setup packages allows a low-privileged local user who can open the driver device to supply a receive-record count exceeding the caller-supplied output buffer length, causing an insufficiently bounded copy and potentially crashing the driver or system. The flaw is local only (AV:L) and affects Windows hosts with the PEAK PCAN driver installed; no public exploit was identified at time of analysis, and the assessed impact is availability only, with no confirmed confidentiality or integrity impact.
Locally exploitable denial-of-service in PEAK-System PCAN Windows CAN device drivers can crash the driver or system when a crafted type 0x4030 processing path selects or returns an object pointer that is dereferenced without validation. Affected systems are Windows hosts running the PEAK-System PCAN Windows CAN device drivers or PEAK-System Device Driver Setup, and exploitation requires local access plus low-level privileges (CVSS 5.5, AV:L/PR:L/UI:N, A:H). No public exploit was identified at time of analysis and no KEV confirmation is present in the provided data; the expected impact is availability loss, not remote compromise or confirmed data theft.
Memory corruption in the PEAK-System PCAN Windows CAN device drivers allows local low-privileged attackers to overflow a fixed-size stack buffer by delivering a crafted record whose DLC field exceeds 0x0f, which the parser uses unchecked to index a length table before copying attacker-controlled data from record+0x1c. Exploitation gives high integrity and availability impact (arbitrary stack memory corruption, likely crash or controlled writes) but no confidentiality impact, and it requires local access with low privileges and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
PEAK-System PCAN Windows CAN device drivers and the PEAK-System Device Driver Setup package contain an output-buffer validation flaw in the PCAN diagnostic call, where the driver writes its diagnostic output record without confirming the caller-supplied buffer is large enough. A local user with existing privileges who can reach the driver interface and supplies an undersized buffer can trigger memory corruption that crashes the driver or service, degrading availability; there is no disclosed path to code execution, data disclosure, or integrity loss. The CISA ICS advisory (ICSA-26-293-01) covers this issue, no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw carries a moderate EPSS-style risk profile given its local attack vector and privileges required.
Local denial of service in the PEAK-System PCAN Windows CAN device driver can be triggered when a record list contains a malformed record: although the parser rejects the record, the processing loop still advances its processed-bytes counter, desynchronizing parsing and producing an out-of-bounds write (CWE-787). The issue affects PEAK-System Device Driver Setup and PCAN Windows CAN device drivers distributed through HMS Networks, and exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis, and there is no CISA KEV confirmation; the assessed impact is availability loss, such as a driver or system crash, rather than code execution or data compromise.