PatchTheCEVCVE-2026-103672: The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f
25
Routine
HIGH 7.1
CVE-2026-103672 is a high-severity flaw (CVSS 7.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 98%) |
| CISA exploited list | No |
| Weakness | CWE-129 |
| Published | 2026-10-20 |
| Last modified | 2026-10-22 |
Publisher (CNA): ICS-CERT
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Official advisories
- CISA Alerts and Advisories: HMS Networks PEAK-System PCAN Windows drivers 2026-10-20
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.