CVE-2018-16098

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-24 · updated 2026-06-17
Weakness: CWE-428

Description

In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.

Affected products

Lenovo Synaptics Thinkpad Ultranav Driver: 18.0.7.119, 19.5.19.33, 19.0.17.140, 19.3.4.219, 16.2.19.23, 18.1.27.42
Lenovo Thiankpad L430 Firmware: all versions
Lenovo Thiankpad L530 Firmware: all versions
Lenovo Thiankpad P1 Firmware: all versions
Lenovo Thiankpad P50S Firmware: all versions
Lenovo Thiankpad P51 Firmware: all versions
Lenovo Thiankpad P51S Firmware: all versions
Lenovo Thiankpad P52S Firmware: all versions
Lenovo Thiankpad P70 Firmware: all versions
Lenovo Thiankpad S1 Yoga Firmware: all versions
Lenovo Thiankpad S430 Firmware: all versions
Lenovo Thiankpad T420 Firmware: all versions
Lenovo Thiankpad T420I Firmware: all versions
Lenovo Thiankpad X1 Extreme Firmware: all versions
Lenovo Thinkpad Helix Firmware: all versions
Lenovo Thinkpad S230U Firmware: all versions
Lenovo Thinkpad T420S Firmware: all versions
Lenovo Thinkpad T420Si Firmware: all versions
Lenovo Thinkpad T430I Firmware: all versions
Lenovo Thinkpad T430S Firmware: all versions
Lenovo Thinkpad T431S Firmware: all versions
Lenovo Thinkpad T440 Firmware: all versions
Lenovo Thinkpad T440P Firmware: all versions
Lenovo Thinkpad T440S Firmware: all versions
Lenovo Thinkpad T460S Firmware: all versions
Lenovo Thinkpad T470 Firmware: all versions
Lenovo Thinkpad T470S Firmware: all versions
Lenovo Thinkpad T520 Firmware: all versions
Lenovo Thinkpad T520I Firmware: all versions
Lenovo Thinkpad T530 Firmware: all versions

References

Get alerted when CVE-2018-16098 or the next vulnerability affects your stack