The PEAK‑System PCAN parser indexes a length table using an attacker‑controlled Data Length Code (DLC) without asserting that DLC is less than or equal to 0x0f, and then copies payload from record+0x1c into a fixed‑size stack buffer. This results in a classic buffer overflow that can be leveraged to execute arbitrary code, a flaw categorized as CWE‑129.

The vulnerability affects HMS Networks PCAN Windows CAN device drivers and the PEAK‑System Device Driver Setup. All versions of the driver before the 5.1.4 release are vulnerable; HMS Networks AB recommends upgrading to version 5.1.4 or later to obtain the fix.

The CVSS score for this issue is 6.9. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require sending malicious CAN frames with an oversized DLC to a system running the vulnerable driver. While the exact prerequisites for exploitation are not explicitly documented, it is inferred that local or network‑level access to the CAN bus would be necessary. No public exploitation has been reported, so the risk is moderate but not negligible. The official mitigation is to upgrade the driver to the fixed 5.1.4 release.