CVE-2026-109576: HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write
Published Oct 20, 2026
·Updated
The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
Affected Software
1 affected component
HMS Networks PEAK-System PCAN Windows drivers
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PEAK-System PCAN Windows driversto a version that resolves this vulnerability.Fixed in 5.1.4
Event History
Oct 20, 2026
CVE Published
via MITRE·08:16 PM
Data Sourced
via MITRE·08:16 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploiting this issue require remote network access?
No. The attack vector is local, so an attacker needs local access to the affected Windows system.
2
What level of access does an attacker need before exploitation?
The vulnerability requires low privileges. It does not require user interaction.
3
What is the expected security impact if exploitation succeeds?
The listed impact is high availability impact, meaning exploitation could significantly disrupt availability. No confidentiality or integrity impact is listed.