This vulnerability involves the PCAN Windows driver performing a variable‑length copy using a record count supplied by the caller. Because the copy is not capped to the actual output buffer length, an attacker may cause the driver to write beyond its intended bounds, leading to memory corruption that could destabilize the system or provide a vector for privilege escalation. The weakness is identified as CWE‑130, an incorrect calculation of buffer size. The official description does not state any remote exploitation mechanism, so the impact is limited to local or compromised systems that can invoke the driver with crafted parameters.

HMS Networks:PCAN Windows CAN device drivers and HMS Networks:PEAK‑System Device Driver Setup are affected. The vendor issued a fix in version 5.1.4; therefore systems running earlier releases of the PEAK‑System PCAN drivers are impacted. Any machine that uses these drivers for CAN communication, regardless of the operating system configuration, requires remediation.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is local: an actor with access to the system can invoke APIs that trigger the overcopy. Because the driver operates with elevated privileges, successful exploitation could allow a determined attacker to crash the kernel or achieve further privilege escalation, depending on the system configuration. The absence of a public exploit and the local nature of the vector reduce immediate risk, but the impact remains significant if the attacker gains local access.