CVE-2026-14256 Memory corruption in 100w Gen 4 Laptop (Lenovo) ELAN TrackPoint Driver for Windows 11 (Version 22H2 or later) - Lenovo 100w Gen 4, 300w Yoga Gen 4, 500w Yoga Gen 4
A local authenticated user can cause a system crash via an out-of-bounds write in the ELAN TrackPoint driver on Lenovo laptops.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14256?
CVE-2026-14256 is a medium-severity memory corruption vulnerability in 100w Gen 4 Laptop (Lenovo) ELAN TrackPoint Driver for Windows 11 (Version 22H2 or later) - Lenovo 100w Gen 4, 300w Yoga Gen 4, 500w Yoga Gen 4, published on 13 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.
Weakness: CWE-125
Which versions are affected by CVE-2026-14256?
How do I fix CVE-2026-14256?
No fix has been published for CVE-2026-14256 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-14256 being exploited?
There is no known exploitation of CVE-2026-14256 in the wild and no public exploit code.
Sources
Also known as GHSA-pxj5-5rw9-phjp.