The PEAK-System PCAN Windows driver contains a flaw where the parser correctly detects malformed records but incorrectly adjusts the processed-bytes counter when a record is rejected. This mismatch can write past the bounds of memory that holds the record list, leading to a memory corruption vulnerability described by CWE‑787. If exploited, an attacker could crash the driver or trigger a code execution path by carefully crafting CAN messages that trigger this condition.

The vulnerability affects HMS Networks PCAN Windows CAN device drivers and the PEAK‑System Device Driver Setup. No specific product versions are enumerated as fixed in the CVE except that HMS Networks has released a patch in driver version 5.1.4 and recommends upgrading to this or later releases.

The CVSS score of 6.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation to date. Based on the description, the likely attack vector involves sending malformed CAN packets to a system that has a PCAN driver installed. The lack of recent exploitation reports and the absence from KEV imply a low to moderate exploitability, though the potential impact warrants mitigation.