Critical Buffer‑Overflow Vulnerabilities in HMS Networks PEAK‑System PCAN Windows Drivers (CVE‑2026‑109576‑105960)

Critical Buffer‑Overflow Vulnerabilities in HMS Networks PEAK‑System PCAN Windows Drivers (CVE‑2026‑109576, CVE‑2026‑101103, CVE‑2026‑94188, CVE‑2026‑103672, CVE‑2026‑110322, CVE‑2026‑105960)

What It Is — Six related flaws in the PEAK‑System PCAN Windows driver suite allow out‑of‑bounds writes, unchecked buffer copies, and improper pointer handling. Successful exploitation can corrupt kernel memory and trigger a system crash (Denial‑of‑Service) on any Windows host running the affected driver version.

Exploitability — CVSS v3.1 base 7.1 (High). No public exploit has been observed, but the vulnerability class (kernel‑mode driver) is historically attractive to sophisticated actors; proof‑of‑concept code is expected to appear soon.

Affected Products —

• PEAK‑System Device Driver Setup ≤ 5.1.2.1151
• PCAN Windows CAN device drivers ≤ 5.1.2

Both are distributed by HMS Networks and are deployed in transportation, healthcare, energy, and critical manufacturing environments worldwide.

Why It Matters for Trust & Control Assurance

• Vulnerability‑Management Control – The flaws test an organization’s ability to maintain an up‑to‑date inventory of third‑party components and to apply patches promptly, a control objective that maps to many frameworks (e.g., NIST CSF Identify ID.RM‑1, ISO 27001 A.12.6).
• Evidence of Due Diligence – Demonstrating that you have continuously monitored driver versions and captured remediation evidence provides a defensible audit trail for regulators and enterprise buyers.
• Defensible Incident‑Response – Knowing that a kernel‑level crash could be weaponised helps shape detection rules and response playbooks, reinforcing the “detect‑and‑respond” control set across frameworks.

Recommended Actions

1. Inventory – Use automated asset discovery to confirm which endpoints run the PEAK‑System PCAN driver and record the exact version.
2. Patch – Deploy the vendor‑supplied update (version 5.1.2.1152 or later) across all affected systems without delay.
3. Validate – Verify patch success via endpoint telemetry and capture the version data as compliance evidence.
4. Monitor – Enable kernel‑mode crash logging and alert on abnormal driver‑related events.
5. Document – Record the remediation steps in your vulnerability‑management system to satisfy audit requirements.

Source: US‑CERT ICS Advisory ICS‑A‑26‑293‑01