PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109576 HMS Networks CVE debrief

A vulnerability in HMS Networks PEAK-System PCAN Windows drivers could allow an attacker to write out-of-bounds data. The parser in the PCAN driver correctly detects malformed records but incorrectly advances its processed-bytes counter for invalid records. This issue may impact system stability and security, particularly for systems using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers. Defenders should assess exposure and prioritize patching or mitigation to prevent potential exploitation.

Vendor
HMS Networks
Product
PEAK-System Device Driver Setup
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-29
Advisory published
2026-10-20
Advisory updated
2026-10-29

Who should care

Defenders responsible for systems using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and stability of their systems.

Why it matters

A vulnerability in HMS Networks PEAK-System PCAN Windows drivers could allow an attacker to write out-of-bounds data, potentially impacting system stability and security.

  • Verify affected versions of PEAK-System Device Driver Setup and PCAN Windows CAN device drivers.
  • Assess exposure of systems using these drivers.
  • Prioritize patching or mitigation for vulnerable systems.
  • Monitor system logs for potential exploitation attempts.

Technical summary

The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid. This vulnerability could allow an attacker to write out-of-bounds data, potentially impacting system stability and security. The issue is particularly relevant for systems using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers. Defenders should prioritize verifying affected systems and apply patches if available.

Defensive priority

Defenders should prioritize verifying affected systems, especially those using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers, and apply patches if available.

Recommended defensive actions

  • Verify affected systems, especially those using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers.
  • Apply patches if available.
  • Monitor system logs for potential exploitation attempts.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. However, details on exploitation, impact, and remediation are limited. Defenders should verify affected systems, especially those using PEAK-System Device Driver Setup and PCAN Windows CAN device drivers, and apply patches if available. The source item providing details on the vulnerability also suggests monitoring system logs for potential exploitation attempts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109576 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109576

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109576 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109576

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109576.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.hms-networks.com/cybersecurity

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.peak-system.com/support/downloads/software/

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-01.json

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.