A driver that ships with industrial adapters can crash the Windows machine it runs on.

CISA, the United States federal cyber agency, published an advisory on 20 October about driver software that lives on one particular kind of computer: the one an engineer plugs into a machine in order to read it. Test benches, commissioning laptops, workshop PCs, fleet diagnostic kit. Someone who already has an ordinary login on one of those machines can make it stop dead.

Nothing here crosses a network. The faults cannot be reached from the internet, and the agency has had no report of anybody using them. The supplier has issued a corrected release and points users at its own download page to get it.

So this is not an emergency. It is an inventory problem, and the reason to pass it on is that the software involved is almost never on anybody's list. The organisations affected are the ones whose engineers talk to machinery through a laptop, which is why the agency tags the item to manufacturing, energy, transport and hospital estates. The people to forward it to are whoever owns the standard build for engineering laptops, and whoever signs off what goes into a contractor's toolkit.

What a stopped bench PC costs

These are the drivers for adapters HMS Networks sells under the PEAK-System PCAN name: small boxes that join a Windows PC to a controller area network, the cheap and durable wiring standard that vehicles, machinery and medical devices use to let their own parts talk to each other. The adapter is how a technician reads a drive fault, trims a parameter, or watches a bus during a test run.

The distinction that matters is between an application fault and a driver fault. An application crash takes the application with it and nothing else. A driver runs inside the kernel, the core of Windows that everything else sits on top of, so a fault there takes the whole computer: no window to close, no session to resume, the machine simply goes down.

Put that on the bench. A commissioning sequence stopped halfway is a sequence run again, with whatever access to the plant that needed booked a second time. A PC left logging an intermittent fault across a night shift becomes a night shift with no log and a fault still unexplained. Neither is a safety event. Neither is free either, and both land as a technician's day, a call-out, or a return visit by somebody who was on site yesterday.

One of the six sits above the others in the agency's own scoring, and it is marked as able to corrupt data as well as halt the machine rather than only halt it. The precondition in every case is the same, and it is modest: an account on the PC, nothing more exotic than that. On a shared bench machine, with a local login that three contractors and two shifts have all used since it was built, modest is the operative word.

The questions this one raises

This is not a decision about plant. It is a decision about a class of computer that tends to fall between the asset register and the IT estate, owned by engineering, patched by nobody in particular.

The first question worth putting to whoever maintains the engineering builds is whether this driver is in them at all, or whether it arrived with hardware an engineer bought on a purchase card and installed to finish a job. The second follows from the answer: who is accountable for keeping it current, the integrator under a maintenance agreement, the OT team, or no one, which is the common answer and the one worth saying out loud.

For the machines that do get found, the question for the supplier or integrator is whether the corrected release is cleared against the applications those PCs run, because a diagnostic laptop is often pinned to an old version of something for a reason that was good at the time.

And where a bench PC cannot be taken out of service to be updated this quarter, the question for the person who owns the test schedule is what the tolerance is for that machine going down unannounced, because that is the same interruption, arriving on somebody else's timing.

Worth knowing where to watch: the agency has carried the vendor's own notice through here and refers readers to it for the detail, so the vendor's advisory is where any revision to the affected ranges will show up first.

The technical record

CISA ICS advisory ICSA-26-293-01, released 20 October 2026. Vendor HMS Networks, headquartered in Sweden, products deployed worldwide.

Affected, as listed: PEAK-System Device Driver Setup at 5.1.2.1151 and earlier; PCAN Windows CAN device drivers at 5.1.2 and earlier.

Remediation: version 5.1.4 carries the fixes, the vendor's guidance is to move to the newest available version, and builds are on the PEAK-System PCAN download page. The advisory also sends readers to the vendor's own security advisory for further detail.

Identifiers and weakness classes:

• CVE-2026-103672, CWE-129, improper validation of an array index. A length table indexed by an unchecked data-length field, then a copy into a fixed-size stack destination.
• CVE-2026-109576, CWE-787, out-of-bounds write. A record-list loop that advanced its byte counter even past records it had already rejected.
• CVE-2026-101103, CWE-120, buffer copy without a size check. A diagnostic call that did not confirm the caller's output buffer was large enough.
• CVE-2026-94188, CWE-120, buffer copy without a size check. A path where the source bytes and an undersized destination are both in the caller's gift.
• CVE-2026-110322, CWE-822, untrusted pointer dereference. An object pointer read without being validated first.
• CVE-2026-105960, CWE-130, improper handling of length parameter inconsistency. A receive-record copy sized from a requested record count rather than from the caller's actual output length.

Scoring: CVE-2026-103672 at CVSS v3.1 base 7.1, high, with integrity and availability impact, and v4.0 6.9. The remaining five at v3.1 base 5.5, medium, availability impact only, and v4.0 6.8. All vectors local, low privileges required, no user interaction.

Exploitation: not reachable remotely, with no public exploitation aimed at the set reported to the agency.

Counting: the summary block gives the total as five while six identifiers are enumerated below it, so the enumerated list is the one to map against an installed estate. Sectors named are transportation, healthcare and public health, energy and critical manufacturing. The advisory closes with the agency's usual segmentation and remote-access guidance.

The fix is published and the download sits where it has always sat. The work in front of most organisations is not patching. It is producing a list of the machines that have this software on them, and that list does not currently exist anywhere.