← Vulnerability feed

Vulnerability record · CVE-2018-16098 · published 24 January 2019

CVE-2018-16098: Lenovo synaptics thinkpad ultranav driver unquoted search path vulnerability

Lenovo · Synaptics Thinkpad Ultranav Driver

In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.

7.8 CVSS 3.0 High EPSS 0.40% · top 67.6% CWE-428 · Unquoted search path
7.8CVSS 3.0 base score, v2 7.2
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
59Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

59 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.lenovo.com/us/en/solutions/LEN-24573 Broken Link
https://support.lenovo.com/bg/en/product_security/len-24573 PatchVendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24573 Broken Link

Track CVE-2018-16098 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2018-16098), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.