noindex and left out of the sitemap until more data is confirmed.CVE-2026-84854 is an out-of-bounds write in the WibuKey dongle-licensing driver that Siemens bundles with its PSS(R)SINCAL power-system-analysis software: insufficient validation of a kernel-buffer size calculation lets a local low-privileged user write past the buffer and crash the system; NVD has deferred its own analysis, so this page stays noindex until a confirmed NVD score is published.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-06
Published
Vulnerability ID: CVE-2026-84854 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens PSS(R)SINCAL (bundled WibuKey licensing driver) | — | PSS SINCAL V21.5 (all versions) and V22.0 (all versions) — manual WibuKey Runtime 6.72+ install required, no official patch; V22.5 before Update 5 — fixed in V22.5 Update 5 |
What this means
CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver for Windows, versions below 6.72, which Siemens bundles with its PSS(R)SINCAL grid-analysis software for legacy dongle-based licensing. Siemens' advisory states the flaw involves "insufficient validation of user input when calculating the size of a kernel buffer," which "could cause small amounts of data to be written outside the intended kernel buffer," leading to a system crash and potential modification of adjacent kernel memory (Siemens ProductCERT Advisory SSA-148322).
Siemens and Wibu-Systems jointly computed a CVSS v3.1 score of 7.0 (high), vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, high attack complexity, low privileges required, no user interaction, with high impact to confidentiality, integrity and availability. NVD's own status for CVE-2026-84854 is "Deferred" as of 2026-10-15, meaning NVD has not published its own independent score, so this page leaves cvss_score unset rather than presenting the Siemens/Wibu-Systems figure as NVD-confirmed (NVD; Siemens ProductCERT Advisory SSA-148322).
Wibu-Systems' own advisory (referenced directly by Siemens' bulletin) identifies the affected driver versions and the fix: WibuKey Runtime 6.72 or later removes the flaw. For PSS SINCAL V22.5 installs before Update 5, Siemens ships the fix directly in Update 5; for the older V21.5 and V22.0 lines, Siemens states there is no dedicated SINCAL patch and instructs customers to manually install the updated WibuKey Runtime from Wibu-Systems (Wibu-Systems Advisory WIBU-100065; Siemens ProductCERT Advisory SSA-148322).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00105 (1.0th percentile) — very low, consistent with a flaw that needs local access and high attack complexity rather than being remotely triggerable (CISA KEV, FIRST EPSS).
Because NVD has deferred its own analysis, this page does not yet meet the minimum data bar for indexing. In the meantime, PSS SINCAL V22.5 users should update to Update 5, and V21.5/V22.0 users should manually install WibuKey Runtime 6.72 or later.
Evidence
- Insufficient kernel-buffer size validation in the WibuKey driver bundled with Siemens PSS(R)SINCAL lets a local low-privileged user write outside the buffer, crashing the system or modifying adjacent kernel memory (CWE-787). — Siemens ProductCERT Advisory SSA-148322
- CVSS v3.1 score 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) computed by Siemens/Wibu-Systems; NVD status is "Deferred" with no NVD-published score as of 2026-10-15. — NVD
- Affects PSS SINCAL V21.5 and V22.0 (all versions, fix is a manual WibuKey Runtime 6.72+ install, no dedicated SINCAL patch) and V22.5 before Update 5 (fixed in Update 5). — Wibu-Systems Advisory WIBU-100065
- Not present in the CISA KEV catalog as of 2026-10-27. — CISA KEV
- EPSS score is 0.00105 (1.0th percentile) as of 2026-10-26. — FIRST EPSS
