Description
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HMS Networks | PEAK-System Device Driver Setup | ≤ 5.1.2.1151 | 5.1.4 |
| HMS Networks | PCAN Windows CAN device drivers | ≤ 5.1.2 | 5.1.4 |
Advisories 1
- ICSA-26-293-01 HMS Networks PEAK-System PCAN Windows drivers CISA ICS & IT advisories · Oct 20, 2026