PEAK-System PCAN
by Hms Networks
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-103672 | hig | 0.46 | 7.1 | — | Oct 20, 2026 | The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. | ||
| CVE-2026-101103 | med | 0.36 | 5.5 | — | Oct 20, 2026 | The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. | ||
| CVE-2026-94188 | med | 0.36 | 5.5 | — | Oct 20, 2026 | The copied source field in PEAK-System PCAN is attacker-influenced through the related file-device write path, and the caller can combine a small output allocation with controlled source bytes. | ||
| CVE-2026-110322 | med | 0.36 | 5.5 | — | Oct 20, 2026 | The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing. | ||
| CVE-2026-105960 | med | 0.36 | 5.5 | — | Oct 20, 2026 | PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. |
- risk 0.46cvss 7.1epss —
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
- risk 0.36cvss 5.5epss —
The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record.
- risk 0.36cvss 5.5epss —
The copied source field in PEAK-System PCAN is attacker-influenced through the related file-device write path, and the caller can combine a small output allocation with controlled source bytes.
- risk 0.36cvss 5.5epss —
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
- risk 0.36cvss 5.5epss —
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.