CVE-2026-105960— HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
Quick assessment
Affected
HMS Networks PEAK-System Device Driver Setup
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PEAK-System PCAN 存在一个涉及可变长度接收记录复制的漏洞操作。该驱动程序在使用请求或已排队的记录数量时，未对复制到实际由调用方提供的输出长度进行充分限制。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105960
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
Source: CVE Program / CVE List V5
Vulnerability Description
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
长度参数不一致性处理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HMS Networks | PEAK-System Device Driver Setup | 0 ~ 5.1.2.1151 | - |
|
| HMS Networks | PCAN Windows CAN device drivers | 0 ~ 5.1.2 | - |
|
II. Public POCs for CVE-2026-105960
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105960
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105960 (1)
Other References for CVE-2026-105960 (3)
Same Patch Batch · HMS Networks · 2026-10-20 · 5 CVEs total
| CVE-2026-103672 | 7.1 HIGH | HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index |
| CVE-2026-101103 | 5.5 MEDIUM | HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow |
| CVE-2026-109576 | 5.5 MEDIUM | HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write |
| CVE-2026-110322 | 5.5 MEDIUM | HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference |
IV. Related Vulnerabilities
Same product: PEAK-System Device Driver Setup
-
CVE-2026-110322
HMS Networks PEAK-System PCAN Windows drivers Untrusted Poin -
CVE-2026-103672
HMS Networks PEAK-System PCAN Windows drivers Improper Valid -
CVE-2026-101103
HMS Networks PEAK-System PCAN Windows drivers Classic Buffer -
CVE-2026-109576
HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds
Same vendor: HMS Networks
-
CVE-2026-110322
HMS Networks PEAK-System PCAN Windows drivers Untrusted Poin -
CVE-2026-103672
HMS Networks PEAK-System PCAN Windows drivers Improper Valid -
CVE-2026-101103
HMS Networks PEAK-System PCAN Windows drivers Classic Buffer -
CVE-2026-109576
HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds -
CVE-2025-0432
HMS Networks Ewon Flexy 202 Cleartext Transmission of Sensit
Same weakness: CWE-130
-
CVE-2026-110912
DragonFly BSD 6.4.2堆栈越界读漏洞 -
CVE-2026-101962
Junos OS and Junos OS Evolved: An attacker sending a malform -
CVE-2026-92159
F´: TlmPacketizer copies oversized telemetry past configured -
CVE-2026-102054
Junos OS and Junos OS Evolved: Insufficient validation of VX -
CVE-2026-101942
Junos OS and Junos OS Evolved: An attacker causes rpd denial
V. Comments for CVE-2026-105960
No comments yet