CVE-2026-105960: HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HMS Networks PEAK-System PCAN Windows driversto a version that resolves this vulnerability.Fixed in 5.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low privileges on a Windows system using the affected PEAK-System PCAN drivers. No user interaction is required.
What is the likely security impact?
The vulnerability can cause a denial of service by triggering an improperly bounded variable-length receive-record copy. The provided metrics indicate no confidentiality or integrity impact.
What should teams do if they cannot patch immediately?
The provided information does not identify a workaround or mitigation. Prioritize limiting local access to systems using the affected drivers and monitor HMS Networks and PEAK-System advisories for vendor guidance.