Threat database

CVE-2026-18909 is a stack-based buffer overflow vulnerability in ELAN Microelectronics Corp.'s ELAN Smart-Pad driver on Windows, specifically in ETD.sys and ETDSMBus.sys. The flaw occurs during Intel SMBus recovery when ETDSMBus.sys fails to enforce an upper bound on a hardware-derived report count, allowing an out-of-range value to be used as a loop counter for a stack buffer copy in ETD.sys without size validation. A local attacker with standard user privileges can trigger a kernel crash (BSOD) causing denial of service. This affects versions up to and including 24.21.52.3. No patch or official remediation has been confirmed yet.