CVE-2026-103672 in PCAN Windows CAN Device Drivers
Summary
by MITRE • 10/20/2026
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
This vulnerability represents a critical buffer overflow flaw within the PEAK-System PCAN driver's parsing logic for Controller Area Network messages. The core technical issue stems from an improper validation of the Data Length Code, which is a field in CAN frames that specifies the number of bytes contained in the message payload. In standard CAN protocol specifications, this value must strictly adhere to constraints where it does not exceed 0x0f or fifteen decimal bytes for classic CAN frames. However, the affected parser fails to enforce this boundary condition when indexing into an internal length table using attacker-controlled input. By accepting DLC values greater than 0x0f without proper bounds checking, the driver allows a malicious actor to manipulate memory access patterns in ways that bypass intended security controls.
The operational consequence of this logic error is severe, as it leads directly to a stack-based buffer overflow. When an oversized Data Length Code is provided, the parser proceeds to copy data from a specific offset within the record structure into a fixed-size destination buffer located on the call stack. Because the source length derived from the unchecked DLC exceeds the capacity of this fixed buffer, excess bytes are written beyond its allocated boundaries. This overwriting corrupts adjacent memory locations, potentially including critical control flow data such as return addresses or function pointers stored on the stack. Such corruption can be exploited to achieve arbitrary code execution with the privileges of the process running the driver, typically kernel-level access in this context.
From a threat modeling perspective, this vulnerability aligns closely with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write. The lack of input validation on the DLC field is a classic example of insufficient boundary checks that allows an attacker to dictate memory write operations beyond safe limits. In terms of attack vectors, this flaw facilitates exploitation through physical or logical access to the CAN bus interface, allowing adversaries to inject malformed frames that trigger the overflow condition remotely if the driver processes incoming traffic automatically. This maps directly to MITRE ATT&CK techniques involving input validation bypasses and potential privilege escalation via memory corruption exploits.
Mitigation strategies must focus on enforcing strict protocol compliance within the driver's parsing routines. Developers should implement explicit checks ensuring that any received DLC value is less than or equal to 0x0f before proceeding with buffer operations. Additionally, employing safer string handling functions that include length parameters can prevent overflows even if validation logic fails. For system administrators and security teams, applying vendor-provided patches promptly is essential to close this gap. In environments where patching is not immediately feasible, network segmentation or filtering rules at the CAN bus gateway level can help block frames with suspiciously high data lengths before they reach the vulnerable driver component.