CVE-2026-109576— HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write
Quick assessment
Affected
HMS Networks PEAK-System Device Driver Setup
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PEAK-System PCAN 驱动程序中的解析器虽然正确检测到了格式错误的记录，但在迭代记录列表时，即使某条记录因无效而被拒绝，其已处理字节计数器仍然继续递增。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109576
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write
Source: CVE Program / CVE List V5
Vulnerability Description
The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HMS Networks | PEAK-System Device Driver Setup | 0 ~ 5.1.2.1151 | - |
|
| HMS Networks | PCAN Windows CAN device drivers | 0 ~ 5.1.2 | - |
|
II. Public POCs for CVE-2026-109576
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109576
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109576 (1)
Other References for CVE-2026-109576 (3)
Same Patch Batch · HMS Networks · 2026-10-20 · 5 CVEs total
| CVE-2026-103672 | 7.1 HIGH | HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index |
| CVE-2026-101103 | 5.5 MEDIUM | HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow |
| CVE-2026-105960 | 5.5 MEDIUM | HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Incons |
| CVE-2026-110322 | 5.5 MEDIUM | HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference |
IV. Related Vulnerabilities
Same product: PEAK-System Device Driver Setup
-
CVE-2026-105960
HMS Networks PEAK-System PCAN Windows drivers Improper Handl -
CVE-2026-110322
HMS Networks PEAK-System PCAN Windows drivers Untrusted Poin -
CVE-2026-103672
HMS Networks PEAK-System PCAN Windows drivers Improper Valid -
CVE-2026-101103
HMS Networks PEAK-System PCAN Windows drivers Classic Buffer
Same vendor: HMS Networks
-
CVE-2026-105960
HMS Networks PEAK-System PCAN Windows drivers Improper Handl -
CVE-2026-110322
HMS Networks PEAK-System PCAN Windows drivers Untrusted Poin -
CVE-2026-103672
HMS Networks PEAK-System PCAN Windows drivers Improper Valid -
CVE-2026-101103
HMS Networks PEAK-System PCAN Windows drivers Classic Buffer -
CVE-2025-0432
HMS Networks Ewon Flexy 202 Cleartext Transmission of Sensit
Same weakness: CWE-787
-
CVE-2026-113300
Chrome 156.0.8078.47 前 Forms 越界写漏洞 -
CVE-2026-100134
Acrobat for Edge | Out-of-bounds Write (CWE-787) -
CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAss -
CVE-2026-93475
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Sec -
CVE-2026-91041
FileX fault-tolerant log replay writes past the destination
V. Comments for CVE-2026-109576
No comments yet