CVE-2026-18909

A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSMBus.sys does not enforce an upper-bound check on the hardware-derived report count, allowing an out-of-range value to be forwarded to ETD.sys where it is used as a loop counter for a stack buffer copy without destination size validation. A local attacker with standard user privileges can trigger a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), resulting in denial of service. This issue affects ELAN Smart-Pad through ETD24.21.52.3.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de desbordamiento de búfer basado en pila existe en ELAN Microelectronics Corp. ELAN Smart-Pad en Windows (ETD.sys y ETDSMBus.sys). Durante la recuperación de Intel SMBus, ETDSMBus.sys no aplica una verificación de límite superior en el recuento de informes derivado del hardware, permitiendo que un valor fuera de rango sea reenviado a ETD.sys donde se utiliza como contador de bucle para una copia de búfer de pila sin validación del tamaño de destino. Un atacante local con privilegios de usuario estándar puede desencadenar un error de kernel (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), lo que resulta en denegación de servicio. Este problema afecta a ELAN Smart-Pad hasta ETD24.21.52.3.

Information

Published : 2026-08-06 05:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18909

Mitre link : CVE-2026-18909

CVE.ORG link : CVE-2026-18909

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-18909", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18909", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T14:19:01.796600Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}], "cvssMetricV40": [{"type": "Secondary", "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.6, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "36106deb-8e95-420b-a0a0-e70af5d245df", "affectedData": [{"vendor": "ELAN Microelectronics Corp.", "modules": ["ETD.sys", "ETDSMBus.sys"], "product": "ELAN Smart-Pad", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ETD24.21.52.3"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-08-06T05:16:40.937", "references": [{"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy", "source": "36106deb-8e95-420b-a0a0-e70af5d245df"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSMBus.sys does not enforce an upper-bound check on the hardware-derived report count, allowing an out-of-range value to be forwarded to ETD.sys where it is used as a loop counter for a stack buffer copy without destination size validation. A local attacker with standard user privileges can trigger a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), resulting in denial of service. This issue affects ELAN Smart-Pad through ETD24.21.52.3."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basado en pila existe en ELAN Microelectronics Corp. ELAN Smart-Pad en Windows (ETD.sys y ETDSMBus.sys). Durante la recuperaci\u00f3n de Intel SMBus, ETDSMBus.sys no aplica una verificaci\u00f3n de l\u00edmite superior en el recuento de informes derivado del hardware, permitiendo que un valor fuera de rango sea reenviado a ETD.sys donde se utiliza como contador de bucle para una copia de b\u00fafer de pila sin validaci\u00f3n del tama\u00f1o de destino. Un atacante local con privilegios de usuario est\u00e1ndar puede desencadenar un error de kernel (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), lo que resulta en denegaci\u00f3n de servicio. Este problema afecta a ELAN Smart-Pad hasta ETD24.21.52.3."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "36106deb-8e95-420b-a0a0-e70af5d245df"}