CVE-2026-103672: HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index
Published Oct 20, 2026
·Updated
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
Affected Software
1 affected component
HMS Networks PEAK-System PCAN Windows drivers
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.1.4
Event History
Oct 20, 2026
CVE Published
via MITRE·08:23 PM
Data Sourced
via MITRE·08:23 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Can this be exploited remotely?
The provided vector identifies this as a local attack (AV:L). An attacker must have access to the affected Windows system.
2
What level of access and interaction are required?
The vector indicates low privileges are required (PR:L), and no user interaction is required (UI:N).
3
What is the expected security impact if exploitation succeeds?
The provided vector indicates high integrity and availability impact, with no confidentiality impact. An attacker could potentially alter system state or disrupt operation.