noindex and left out of the sitemap until more data is confirmed.CVE-2026-110322 is an untrusted-pointer-dereference bug in HMS Networks' PEAK-System PCAN Windows CAN-bus drivers, used to connect industrial PCs to CAN-bus networks, that lets a low-privileged local user crash the Windows kernel, but NVD's own vulnerability-status field is "Awaiting Analysis" with no NVD-published Primary score, only a CNA-attributed (ICS-CERT) rating, so per our indexing policy this page stays pending with no NVD-confirmed cvss_score.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-20
Published
Vulnerability ID: CVE-2026-110322 · Source: NVD (ICS-CERT CNA score only, not NVD Primary; vulnStatus: Awaiting Analysis)
Affected components
| Component | CPE | Version range |
|---|---|---|
| PEAK-System PCAN Windows CAN-bus Drivers (HMS Networks) | — | PEAK-System Device Driver Setup before 5.1.2.1151; PCAN Windows CAN device drivers before 5.1.2 (fixed in 5.1.4) |
What this means
CVE-2026-110322 is a CWE-822 (Untrusted Pointer Dereference) vulnerability in the Windows kernel-mode drivers for PEAK-System PCAN CAN-bus interface hardware, a product line of HMS Networks AB used to connect PCs to CAN-bus (Controller Area Network) fieldbus links common in industrial and automotive control systems. CISA's ICS advisory describes the flaw precisely: "The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing" (CISA ICS Advisory ICSA-26-293-01).
NVD lists this CVE with vulnStatus: Awaiting Analysis — NVD has not yet performed its own independent analysis or published a Primary CVSS score. The only metric on record is a CNA-attributed (ICS-CERT) rating of CVSS v3.1 5.5 (medium), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H — a local attack vector requiring low privileges, with impact limited to availability — and CVSS v4.0 6.8 from the same CNA source, not from NVD itself, so neither figure is NVD-confirmed and neither is used as this page's cvss_score (NVD).
CISA's advisory states the overall risk evaluation as "Successful exploitation of these vulnerabilities could crash the Windows kernel" (one of six related PCAN driver CVEs disclosed in this advisory; this page covers the untrusted-pointer-dereference flaw specifically). It credits Seyeon Bang with reporting the issue to CISA, and states explicitly: "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." HMS Networks' remediation: "HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version" (CISA ICS Advisory ICSA-26-293-01).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.00114 (0.11%), 1.46th percentile — among the lowest possible, consistent with a local-only kernel-crash bug that requires a local low-privileged session rather than any internet-facing path, and the CVE is not on CISA's KEV catalog. Given the local attack vector and availability-only impact, this is best read as a low-severity local denial-of-service risk, not a remotely scannable or exploitable flaw, and the low EPSS/no-KEV combination should not be overstated into any scanning signal (FIRST EPSS).
Until NVD completes its own scoring, treat the 5.5/6.8 figures as indicative only, not NVD-confirmed. Any Windows host running PEAK-System PCAN drivers before 5.1.2.1151 (setup) / 5.1.2 (driver) should upgrade to version 5.1.4 or later.
Evidence
- The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing, letting a local user crash the Windows kernel. — CISA ICS Advisory ICSA-26-293-01
- NVD's vulnStatus for this CVE is Awaiting Analysis, with no NVD-published Primary score; the only metrics on record (CVSS v3.1 5.5, CVSS v4.0 6.8) are CNA (ICS-CERT) attributed, not NVD's own analysis. — NVD
- CISA states no known public exploitation has been reported, credits Seyeon Bang for the report, and HMS Networks addressed the issue in driver version 5.1.4. — CISA ICS Advisory ICSA-26-293-01
- EPSS score is 0.00114 (0.11%), 1.46th percentile, as of 2026-10-28; not listed on the CISA KEV catalog. — FIRST EPSS
