Is there a patch available for CVE-2026-14256?

Yes, a patch is available for CVE-2026-14256. Update the affected software to the latest version immediately.

ELAN TrackPoint Driver CVE-2026-14256

Q: What is the CVSS score of CVE-2026-14256?

CVE-2026-14256 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-58062 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-13 lenovo

GHSA-pxj5-5rw9-phjp

5.7

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Local vector with high complexity (specific triggering conditions required), low-privilege authenticated access, no scope change, and availability-only impact (system crash); no confidentiality or integrity impact indicated.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 13, 2026 - 16:18 EUVD

Analysis Generated

Aug 13, 2026 - 16:10 vuln.today

CVE Published

Aug 13, 2026 - 14:54 cve.org

MEDIUM 5.7

DescriptionCVE.org

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

AnalysisAI

Out-of-bounds memory access in the ELAN TrackPoint device driver on Lenovo ThinkPad and related laptops allows a local authenticated user to crash the operating system under specific conditions, resulting in a denial-of-service. Disclosed by Lenovo via advisory LEN-213604, the vulnerability spans a very large number of ThinkPad model lines running Windows 10 and Windows 11. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its local-only, high-complexity attack profile.

Technical ContextAI

The vulnerability resides in the ELAN TrackPoint device driver, a kernel-mode Windows driver responsible for managing the TrackPoint pointing stick hardware on affected Lenovo laptops. The CVE description characterizes the root cause as an out-of-bounds write, though the assigned CWE-125 designates an out-of-bounds read - a discrepancy that warrants verification against the Lenovo advisory. In either case, out-of-bounds memory access flaws in kernel drivers arise when length or boundary checks are insufficient, allowing memory operations to reference addresses outside an intended buffer. In kernel space, such accesses can corrupt critical data structures or trigger invalid memory dereferences, producing a system crash (Blue Screen of Death on Windows). The CVSS 4.0 vector's AT:P metric (Attack Requirements: Present) signals that specific, non-default conditions must align for exploitation, corroborated by the advisory's 'under certain circumstances' language. Affected CPE strings confirm the vulnerable component is the driver package distributed per-model for Windows 10 and Windows 11 across ThinkPad generations from Gen 1 (older X1 Nano, L13 Gen 2) through the most recent Gen 7-8 and Gen 10 releases.

RemediationAI

The primary remediation is to update the ELAN TrackPoint driver to the fixed version published in Lenovo security advisory LEN-213604, available at https://support.lenovo.com/us/en/product_security/LEN-213604. No exact patched driver version number was available in the provided intelligence data - the Lenovo advisory must be consulted to identify the correct fixed driver package for each specific model and Windows version combination. Driver updates can be applied through Lenovo Vantage (recommended for most enterprise deployments), Lenovo System Update, or by manually downloading the driver package from the Lenovo support portal using the model type number. As a compensating control pending patching, organizations may disable the ELAN TrackPoint device in Windows Device Manager, which prevents the vulnerable driver code path from being invoked; note that this removes TrackPoint pointing stick functionality entirely and may impact productivity for users who rely on it. Restricting local interactive logon rights to only trusted administrative accounts reduces the authenticated attacker surface, though this is a broad control with operational trade-offs. Physical access controls to affected workstations further limit exploitation opportunities given the local-only attack vector.