The PEAK‑System PCAN type 0x4030 processing path fails to validate a selected or returned object pointer before dereferencing fixed fields during post‑processing. This untrusted pointer dereference (CWE‑822) can corrupt memory and potentially allow execution of arbitrary code with the privileges of the driver process.

Affected products include HMS Networks’ PCAN Windows CAN device drivers and the PEAK‑System Device Driver Setup. Versions prior to 5.1.4 are vulnerable; the issue was addressed in the 5.1.4 release and later. Older installations of the PCAN drivers or the driver setup package should be identified and updated.

The CVSS score of 6.8 places this flaw in the moderate range. No EPSS score is available and it is not listed in the CISA KEV catalog, indicating limited evidence of active exploitation. The vulnerability is likely remote only within the scope of the driver’s privileged execution context and may require an attacker to interact with the PCAN device or to run code with sufficient privileges to load the driver. The risk is therefore moderate, but unpatched systems remain susceptible to local privilege escalation or stability issues.