Medium severity5.5NVD Advisory· Published Oct 20, 2026

CVE-2026-105960

Description

PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.

Affected products

Peak System/PCANllm-create

Patches

Vulnerability mechanics

References

github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-01.jsonnvd
www.cisa.gov/news-events/ics-advisories/icsa-26-293-01nvd
www.hms-networks.com/cybersecuritynvd
www.peak-system.com/support/downloads/software/nvd

News mentions

HMS Networks PEAK-System PCAN Windows drivers
CISA ICS Advisories

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000