Live › vulnerability › CVE-2026-103672
Go to dashboardThe PEAK-System PCAN parser uses an attacker-supplied DLC value to index a length table without checking that it is 0x0f or less. The payload is then copied into a fixed-size stack buffer, which can overflow and may let an attacker run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PEAK-System Device Driver Setup | vendor | <= 5.1.2.1151 | 5.1.4 |
| PCAN Windows CAN device drivers | vendor | <= 5.1.2 | 5.1.4 |
5.1.2.1151 or PCAN driver <= 5.1.2; 5.1.4 is fixedUpgrade to PEAK-System PCAN Windows driver / Device Driver Setup 5.1.4 or newer (https://www.peak-system.com/support/downloads/software/).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
This page as .md · .json · in your agent: get_signal("CVE-2026-103672")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.