HMS Networks PEAK-System PCAN Windows drivers

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could crash the Windows kernel.</strong></p> <p>The following versions of HMS Networks PEAK-System PCAN Windows drivers are affected:</p> <ul> <li>PEAK-System Device Driver Setup &lt;=5.1.2.1151 (CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, CVE-2026-105960)</li> <li>PCAN Windows CAN device drivers &lt;=5.1.2 (CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, CVE-2026-105960)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">CVSS</th> <th role="columnheader">Vendor</th> <th role="columnheader">Equipment</th> </tr> </thead> <tbody> <tr> <td>v3 7.1</td> <td>HMS Networks</td> <td>PEAK-System Device Driver Setup</td> </tr> </tbody> </table> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">5 Vulnerabilities</th> </tr> </thead> <tbody> <tr> <td>Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Validation of Array Index, Untrusted Pointer Dereference, Improper Handling of Length Parameter Inconsistency</td> </tr> </tbody> </table> </div> <h3>Background</h3> <ul> <li><strong>Critical Infrastructure Sectors: </strong>Transportation Systems, Healthcare and Public Health, Energy, Critical Manufacturing</li> <li><strong>Countries/Areas Deployed: </strong>Worldwide</li> <li><strong>Company Headquarters Location: </strong>Sweden</li> </ul> <hr> <h2>Vulnerabilities</h2> <div class="icsa-etb-toggle-wrapper"><a class="icsa-etb-toggle-all" href="#">Expand All +</a></div> <div class="c-expandable-textb