A classic stack buffer overflow exists in the PEAK-System PCAN diagnostic call. The driver fails to verify that the caller‑supplied output buffer is large enough to contain the returned record. When an attacker crafts an oversized buffer, the driver can overwrite adjacent memory, potentially executing arbitrary code with the privileges of the driver process, which typically runs at kernel level. This flaw permits significant compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability affects HMS Networks PCAN Windows CAN device drivers and the PEAK‑System Device Driver Setup. Version 5.1.4 of the software includes the fix, and users are urged to upgrade to that or newer releases. Earlier releases that have not applied the update are susceptible. The advisory does not list a specific vulnerable version range beyond the recommendation to update.

The CVSS score of 6.8 indicates a moderately severe risk. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, and the flaw is not yet listed in CISA’s KEV catalog. The attack likely requires that an adversary can invoke the diagnostic API on a system having the vulnerable driver, which may be possible via local privilege escalation or exploitation of another vulnerability that allows execution of that call. Because the driver runs in kernel context, a successful exploit could translate into full system compromise.