Siemens has disclosed a high-severity bug in a third-party licensing driver bundled with its PSS SINCAL power system software, and only one affected version has a proper patch.
The flaw, tracked as CVE-2026-84854, sits in the WibuKey driver. Insufficient validation of user input when calculating the size of a kernel buffer can push small amounts of data outside that buffer. The usual result is a system crash, which means denial of service. Siemens said that under unfavorable circumstances, adjacent kernel memory may be modified. The advisory scores it 7 (High) on CVSS 3.1.
The exposure is narrower than the product list suggests. PSS SINCAL is affected only when configured for the legacy WibuKey dongle license type. The scoring vector also shows local access, low privileges and high attack complexity, so this is not a bug someone triggers from across the internet.
Affected versions are V21.5 and V22.0 (all builds) and V22.5 before Update 5. V22.5 users can update to Update 5 or later. For V21.5 and V22.0, Siemens lists no fix yet and said it is preparing updates. The interim mitigation is to manually install WibuKey Runtime for Windows 6.72 or later, which Wibu-Systems distributes.
The pattern is familiar: a vendor ships a bundled dependency, and the dependency carries the flaw. Dongle drivers run in the kernel, where even a small memory-handling error has outsized consequences. Siemens' own wording reflects that, with its mention of kernel memory modification.
For operators, the practical question is whether any machine still depends on the old dongle licensing. Siemens also urged grid operators to confirm that redundant protection schemes are in place, so a crashed workstation cannot affect grid reliability. Siemens first published the advisory October 13, and a republication followed October 22. Whether the V21.5 and V22.0 updates arrive before more sites run into the dongle question remains unanswered.