Toshiba/Dynabook Generic IO & Memory Access Driver Memory Disclosure CVE-2026-56328

Vulnerability Overview Vulnerability Name: Generic IO & Memory Access Driver on TOSHIBA / Dynabook Drivers Publication Date: June 19, 2026 Last Update Date: June 24, 2026 Vulnerability Description: - This vulnerability allows non-privileged users to access physical memory. - Vulnerability ID: CVE-2026-56328 - CVSS Score: 6.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - Vulnerability Type: CWE-102: Exposed IOCTL with Insufficient Access Control Impact Scope Affected Products: - Generic IO & Memory Access drivers installed on TOSHIBA / Dynabook PCs provided between 2009 and 2016. - See the list of specific models at the bottom of the page. Remediation Recommended Actions: - Uninstall the affected driver. - After uninstallation, passwords can no longer be configured unless reset via the BIOS setup tool. - Instructions for configuring a BIOS password: - Launch BIOS Setup Tool / Restore Default Settings (Notebook) - Launch BIOS Setup Tool / Restore Default Settings (Desktop) - For detailed update information and region-specific details, please refer to the local product support page. References Japan: https://dynabook.com/assistpc/info/2026/20260619_security.htm United States: https://support.dynabook.com/support/en-us/content/detail?contentId=618224 Europe: https://support.emea.dynabook.com/bx01TSB650200000651.htm China: https://www.dynabuck-china.com/support/ Taiwan: https://tw.dynabook.com/support/ Acknowledgments Thanks to Akito Yada (Veium) for the disclosure. Revision History June 19, 2026: Initial release June 22, 2026: Added URLs for each region June 24, 2026: Updated vulnerability description and references List of Affected Models See the list of specific models at the bottom of the page, including PNX04, PNX07, PNX08, etc. --- Note: No Proof of Concept (POC) code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Toshiba/Dynabook Generic IO & Memory Access Driver Memory Disclosure CVE-2026-56328