noindex and left out of the sitemap until more data is confirmed.CVE-2026-103672 is a stack-based buffer overflow in HMS Networks' PEAK-System PCAN Windows CAN driver, caused by indexing a length table with an unvalidated, attacker-controlled DLC field, that lets a local low-privileged attacker crash the Windows kernel; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-20
Published
Vulnerability ID: CVE-2026-103672 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| HMS Networks PEAK-System Device Driver Setup / PCAN Windows CAN device drivers | — | PEAK-System Device Driver Setup through 5.1.2.1151 and PCAN Windows CAN device drivers through 5.1.2 (both fixed in Device Driver Setup 5.1.4.1200 / PCAN drivers 5.1.4.20123); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-103672 is an improper validation of array index (CWE-129) in the PEAK-System PCAN Windows CAN device driver, part of HMS Networks' PEAK-System Device Driver Setup package used to manage PEAK CAN/LIN hardware interfaces. NVD's description states the driver's parser "indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination," which results in a stack buffer overflow inside the kernel-mode driver (NVD).
NVD tracks the CVE with status "Received" as of 2026-10-22: the only CVSS data on record is the CISA ICS-CERT-submitted score — CVSS v3.1 7.1 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, and CVSS v4.0 6.9 (medium) — with no NVD-published independent score or CPE applicability statement yet, so this page leaves cvss_score unset rather than presenting that figure as NVD-confirmed (NVD).
CISA's ICS advisory ICSA-26-293-01, published 2026-10-20, bundles CVE-2026-103672 with five related driver flaws (CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-110322, CVE-2026-105960) affecting the same products, credits researcher Seyeon Bang, states exploitation requires only local, low-privileged access with no known public exploitation, and lists the fix as Device Driver Setup 5.1.4.1200 (PCAN drivers 5.1.4.20123), available from HMS Networks' standard software download page (CISA ICS Advisory ICSA-26-293-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00126 (2.1th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of PEAK-System PCAN Windows CAN interfaces should upgrade to Device Driver Setup 5.1.4.1200 (PCAN drivers 5.1.4.20123) and validate the update against a spare system first if a production test station depends on specific RP1210-C or UDS API behavior, since those APIs were updated alongside the fix.
Evidence
- Unvalidated attacker-controlled DLC used to index a length table, then copies payload into a fixed-size kernel stack buffer, causing a stack-based buffer overflow (CWE-129). — NVD
- NVD status is "Received" with CISA ICS-CERT-submitted CVSS v3.1 7.1 and CVSS v4.0 6.9; no NVD-published score or CPE configuration as of 2026-10-22. — NVD
- Affects PEAK-System Device Driver Setup through 5.1.2.1151 and PCAN Windows CAN device drivers through 5.1.2, fixed in Device Driver Setup 5.1.4.1200 / PCAN drivers 5.1.4.20123; local, low-privileged attack, no known public exploitation; bundled with five related driver CVEs in the same advisory. — CISA ICS Advisory ICSA-26-293-01
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.00126 (2.1th percentile) as of 2026-10-21. — FIRST EPSS
