CVE-2026-103672
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload
CVSS
7.1
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-129
Not enough EPSS history yet.
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
- github.comhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-01.json
- www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
- www.hms-networks.comhttps://www.hms-networks.com/cybersecurity
- www.peak-system.comhttps://www.peak-system.com/support/downloads/software/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-92449——
———`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.7hCVE-2026-487417.5 HIG36.0%
——11libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.4dCVE-2026-1109344.4 MED1.0%
——0Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.
This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.5dCVE-2026-92152—51.1%
——15F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.6dCVE-2026-773756.5 MED22.2%
——7SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.7dCVE-2026-1092515.3 MED13.8%
——4FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.3d