CVE-2026-18909: ELAN Smart-Pad Buffer Overflow Vulnerability

CVE-2026-18909 Overview

CVE-2026-18909 is a stack-based buffer overflow vulnerability in ELAN Microelectronics Corp. ELAN Smart-Pad drivers on Windows. The flaw resides in ETD.sys and ETDSMBus.sys, which handle Intel System Management Bus (SMBus) communications for the touchpad hardware. During SMBus recovery, ETDSMBus.sys fails to enforce an upper-bound check on a hardware-derived report count. The unchecked value is forwarded to ETD.sys and used as a loop counter for a stack buffer copy without destination size validation. A local attacker with standard user privileges can trigger a kernel bugcheck, resulting in a denial-of-service condition on affected Windows systems.

Critical Impact
A local user can cause a kernel-mode crash (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), producing an availability-impacting denial of service on any Windows host running ELAN Smart-Pad through ETD24.21.52.3.

Affected Products

ELAN Microelectronics Corp. ELAN Smart-Pad on Windows
Driver components ETD.sys and ETDSMBus.sys
All versions through ETD24.21.52.3

Discovery Timeline

2026-08-06 - CVE-2026-18909 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18909

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] spanning two cooperating kernel-mode drivers. ETDSMBus.sys is the lower-level driver responsible for communicating with the ELAN touchpad over the Intel SMBus. ETD.sys is the higher-level function driver that consumes the data supplied by ETDSMBus.sys and forwards input reports to user-mode components.

During an SMBus recovery sequence, ETDSMBus.sys reads a report count value derived from hardware registers. The driver does not validate this value against an expected maximum before passing it upward. ETD.sys then uses the attacker-influenceable count as the iteration bound for a copy loop targeting a fixed-size stack buffer. When the count exceeds the buffer capacity, the loop writes past the end of the buffer and corrupts the kernel stack, triggering the Windows kernel stack cookie check and bugcheck 0xF7 DRIVER_OVERRAN_STACK_BUFFER.

Root Cause

The root cause is missing input validation across a driver trust boundary. ETDSMBus.sys treats hardware-supplied data as trusted, and ETD.sys treats data from ETDSMBus.sys as trusted. Neither driver validates that the report count fits within the destination stack buffer before the copy loop executes.

Attack Vector

Exploitation requires local access with standard user privileges. An attacker uses the exposed device interface to reach a code path that invokes the SMBus recovery flow, causing the vulnerable copy in ETD.sys to run with an out-of-range counter. The stack cookie protection intercepts the corruption and forces a bugcheck. No public proof-of-concept or in-the-wild exploitation has been reported. The impact is limited to availability; there is no confirmed path to code execution because the overflow is caught by kernel stack integrity checks.

See the EMC Vulnerability Disclosure Policy for vendor coordination details.

Detection Methods for CVE-2026-18909

Indicators of Compromise

Windows bugcheck events with code 0xF7 DRIVER_OVERRAN_STACK_BUFFER in memory dumps or System event logs.
Crash dumps referencing ETD.sys or ETDSMBus.sys in the faulting module stack trace.
Repeated unexpected reboots on endpoints with ELAN Smart-Pad drivers installed at or below ETD24.21.52.3.

Detection Strategies

Collect and centralize Minidump and WER (Windows Error Reporting) artifacts and alert on BugCheckCode = 0xF7 correlated with the ELAN driver modules.
Inventory endpoints for ETD.sys and ETDSMBus.sys versions and flag any at or below ETD24.21.52.3.
Monitor for user-mode processes issuing repeated DeviceIoControl calls to the ELAN device interface immediately preceding a system crash.

Monitoring Recommendations

Forward kernel crash telemetry, driver load events, and Event ID 1001 (BugCheck) to your SIEM for correlation.
Track driver version drift across the fleet to confirm patch rollout progress.
Alert on standard-user processes that load or interact with kernel driver interfaces outside expected baselines.

How to Mitigate CVE-2026-18909

Immediate Actions Required

Identify all Windows systems running ELAN Smart-Pad drivers ETD.sys and ETDSMBus.sys through version ETD24.21.52.3.
Apply the fixed driver package from ELAN Microelectronics as soon as it is available through OEM update channels.
Restrict local logon on affected hosts to trusted users until the update is deployed.

Patch Information

ELAN Microelectronics distributes touchpad drivers primarily through OEM laptop vendors. Refer to the EMC Vulnerability Disclosure Policy and the specific OEM support portal for the updated driver package superseding ETD24.21.52.3. Deploy through standard Windows Update, OEM update utilities, or endpoint management tooling.

Workarounds

Where the touchpad is not required, disable the ELAN Smart-Pad device in Device Manager to unload the vulnerable drivers.
Limit interactive local access on affected endpoints to reduce the pool of users able to trigger the bugcheck.
Enable crash dump collection so that any exploitation attempts generate forensic artifacts for investigation.

bash

# Enumerate ELAN driver versions across Windows endpoints
Get-WmiObject Win32_SystemDriver -Filter "Name='ETD' OR Name='ETDSMBus'" |
  Select-Object Name, PathName, State, Started

# Retrieve file version of the loaded drivers
Get-Item "C:\Windows\System32\drivers\ETD.sys","C:\Windows\System32\drivers\ETDSMBus.sys" |
  ForEach-Object { $_.VersionInfo | Select-Object FileName, FileVersion }