Multiple Vulnerabilities in HMS Networks PEAK-System PCAN Windows Drivers Could Lead to Kernel Crashes
CISA has identified several critical vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers, potentially allowing attackers to crash the Windows kernel.
CISA has issued a security advisory detailing multiple vulnerabilities affecting HMS Networks PEAK-System PCAN Windows drivers. These flaws, present in versions up to and including 5.1.2.1151 for the Device Driver Setup and 5.1.2 for the PCAN Windows CAN device drivers, could be exploited to cause a Windows kernel crash, severely impacting system stability and availability.
The vulnerabilities stem from several weaknesses in how the drivers handle input data. These include out-of-bounds writes, buffer overflows, and improper validation of array indices. Specifically, CVE-2026-109576 describes a scenario where a parser incorrectly advances a byte counter even when a malformed record is rejected. CVE-2026-101103 highlights that diagnostic calls do not validate the size of the output buffer, potentially leading to data corruption. Additionally, CVE-2026-94188 points to an issue where attacker-influenced source fields can be combined with small output allocations, leading to vulnerabilities.
These vulnerabilities span across several Common Weakness Enumerations (CWEs), including CWE-787 (Out-of-bounds Write), CWE-120 (Buffer Copy without Checking Size of Input), and CWE-119 (Improper Validation of Array Index). The potential impact of successful exploitation is a denial-of-service condition, manifesting as a Windows kernel crash. While the vulnerabilities are rated with CVSS v3.1 scores of 5.5 (MEDIUM) and CVSS v4.0 scores of 6.8 (MEDIUM) for specific instances, the potential for system instability in critical infrastructure environments warrants significant attention.
The affected products include HMS Networks' PEAK-System Device Driver Setup and PCAN Windows CAN device drivers. These components are widely deployed across various critical infrastructure sectors globally, including Transportation Systems, Healthcare and Public Health, Energy, and Critical Manufacturing. The broad applicability of these drivers means that a wide range of industrial control systems (ICS) and operational technology (OT) environments could be at risk.
HMS Networks has responded to these findings by releasing version 5.1.4 of its PEAK-System PCAN software. The company strongly recommends that users upgrade to the latest available version to remediate these security issues. Software updates can be found on the HMS Networks software download page. Further details and mitigation guidance are also available in the associated HMS security advisory.
CISA advises users and administrators to review the advisory and apply the necessary updates promptly. Given the potential for kernel crashes, organizations operating in critical infrastructure sectors should prioritize patching these vulnerabilities to maintain the integrity and availability of their systems. The advisory also provides links to the CSAF (Cybersecurity Automation Framework) summary for more detailed technical information.
This advisory serves as a reminder of the ongoing security challenges within the industrial control systems landscape. Vulnerabilities in device drivers, especially those used in critical infrastructure, can have far-reaching consequences. Proactive patching and vigilant monitoring remain essential for protecting these vital systems from potential disruption.