{"id":"CVE-2026-105960","kind":"vulnerability","aliases":["CVE-2026-105960"],"related":[],"title":"PEAK-System PCAN driver: receive-record copy can exceed caller buffer","description":"PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.","summary":"PEAK-System's PCAN driver copies a variable-length receive record using a requested or queued record count without capping the copy to the caller's output buffer length. The sources do not state what an attacker can read or write beyond that buffer or what privilege they need.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","pcan","peak-system","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:44:37+00:00","updated_at":"2026-10-25T03:44:37+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T03:44:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"PEAK-System PCAN driver: receive-record copy can exceed caller buffer","impact":"medium","summary":"PEAK-System's PCAN driver copies a variable-length receive record using a requested or queued record count without capping the copy to the caller's output buffer length. The sources do not state what an attacker can read or write beyond that buffer or what privilege they need.","category":"infrastructure","nicknames":[],"who_cares":["peak-system","pcan","windows"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; the sources do not say what an attacker gets","analyst_note":"Find the NVD entry and PEAK-System advisory to confirm affected driver versions, the trigger path, and whether the copy overflow is local-only or reachable from a lower-privileged user.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000515,"input_tokens":3284,"output_tokens":374,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105960':16A,19A '-2026':15A,18A 'actual':110C 'attack':64B 'beyond':69B 'buffer':13A,55B,71B 'caller':12A,52B,112C 'caller-suppli':111C 'cap':47B,105C 'contain':81C 'copi':9A,32B,49B,93C,107C 'count':45B,102C 'cve':14A,17A 'driver':5A,31B,95C 'exceed':11A 'infrastructur':20B 'involv':85C 'length':36B,56B,89C,115C 'need':76B 'oper':84C 'output':54B,114C 'pcan':4A,21B,30B,80C 'peak':2A,23B,27B,78C 'peak-system':1A,22B,26B,77C 'privileg':74B 'queu':43B,100C 'read':66B 'receiv':7A,37B,91C 'receive-record':6A,90C 'record':8A,38B,44B,92C,101C 'request':41B,98C 'sourc':58B 'state':61B 'suffici':104C 'suppli':113C 'system':3A,24B,28B,79C 'use':39B,96C 'variabl':35B,88C 'variable-length':34B,87C 'vulner':83C 'window':25B 'without':46B,103C 'write':68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105960","severity":null,"published_at":"2026-10-20T21:17:15+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}