CVE-2026-110322: HMS Networks PEAK-System PCAN untrusted pointer dereference

CVE-2026-110322 · Severity: medium · CVSS 5.5 · Published 2026-10-20

HMS Networks PEAK-System PCAN is a Windows driver for CAN bus communication used in industrial control systems. A flaw in the type 0x4030 processing path fails to validate object pointers before use, potentially allowing a local attacker to crash the Windows kernel and cause a denial of service in critical infrastructure environments.

Technologies: HMS Networks PCAN Windows CAN device drivers, HMS Networks PEAK-System Device Driver Setup. Vendors: HMS Networks.

Quick answers

Is CVE-2026-110322 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110322 being exploited in the wild.
How severe is CVE-2026-110322?
Medium severity, with a CVSS score of 5.5, published 20 October 2026.
Which products and versions are affected?
HMS Networks PCAN Windows CAN device drivers <=5.1.2; HMS Networks PEAK-System Device Driver Setup <=5.1.2.1151.
Is there a fix for CVE-2026-110322?
Yes: fixed in HMS Networks PEAK-System Device Driver Setup 5.1.4, PCAN Windows CAN device drivers 5.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110322 attacked?
It is attacked with local access.
Am I affected by CVE-2026-110322?
Check whether you run HMS Networks PCAN Windows CAN device drivers or HMS Networks PEAK-System Device Driver Setup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: HMS Networks PEAK-System Device Driver Setup 5.1.4, PCAN Windows CAN device drivers 5.1.4

Technical details

The vulnerability is an untrusted pointer dereference in the PEAK-System PCAN driver's type 0x4030 processing path where an object pointer returned from a selection operation is dereferenced without validation. A local attacker with limited privileges can trigger kernel memory corruption by providing a malformed request. Exploitation requires local access to the system.

Affected products

  • HMS Networks PEAK-System Device Driver Setup <=5.1.2.1151
  • HMS Networks PCAN Windows CAN device drivers <=5.1.2

Timeline

  • 2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.