EUVD-2026-53707
GHSA-558p-f327-84r7
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X
Local-only access (AV:L), high complexity to trigger SMBus recovery (AC:H), standard user sufficient (PR:L); kernel BSOD from user space constitutes scope change (S:C), purely availability impact.
Primary rating from Vendor (ELAN).
CVSS VectorVendor: ELAN
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSMBus.sys does not enforce an upper-bound check on the hardware-derived report count, allowing an out-of-range value to be forwarded to ETD.sys where it is used as a loop counter for a stack buffer copy without destination size validation. A local attacker with standard user privileges can trigger a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), resulting in denial of service. This issue affects ELAN Smart-Pad through ETD24.21.52.3.
AnalysisAI
Stack-based buffer overflow in ELAN Smart-Pad Windows kernel drivers ETD.sys and ETDSMBus.sys allows a local standard-privilege user to crash the entire Windows system via a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER). The vulnerability is rooted in the Intel SMBus recovery code path: ETDSMBus.sys accepts a hardware-derived report count without enforcing an upper bound and forwards it to ETD.sys, where it drives an unbounded stack buffer copy. A proof-of-concept exists (CVSS 4.0 E:P) and no confirmed patch version has been identified from available data; no active exploitation is listed in CISA KEV at time of analysis.
Technical ContextAI
The affected component is the ELAN Smart-Pad touchpad driver stack for Windows, identified by CPE cpe:2.3:a:elan_microelectronics_corp.:elan_smart-pad:*:*:*:*:*:*:*:* through version ETD24.21.52.3. The system consists of two cooperating kernel-mode drivers: ETDSMBus.sys, which interfaces with the Intel SMBus hardware bus used for touchpad communication, and ETD.sys, which processes input reports. CWE-121 (Stack-based Buffer Overflow) describes the root cause class precisely: during an SMBus recovery sequence, ETDSMBus.sys reads a report count value directly from hardware without validating that it falls within an expected maximum. This unchecked value is then passed to ETD.sys, which uses it as a loop iteration counter for copying data into a fixed-size stack buffer, with no destination size check. When the hardware-derived count exceeds the buffer capacity, the kernel stack is overwritten, triggering a 0xF7 DRIVER_OVERRAN_STACK_BUFFER bugcheck and full system crash. Because both components execute in kernel mode (Ring 0), a stack corruption there cannot be contained to user space and immediately terminates the OS.
RemediationAI
The primary recommended action is to check the ELAN vulnerability disclosure policy at https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy and contact ELAN Microelectronics or the OEM vendor (e.g., ASUS, HP, Lenovo, or other laptop manufacturer) for an updated driver package superseding ETD24.21.52.3. No specific patched version number is independently confirmed from the available data, so organizations should verify the latest driver release directly with their hardware OEM or ELAN. As a compensating control, restricting physical and interactive logon access to affected endpoints (e.g., enforcing kiosk mode or removing standard user interactive sessions on sensitive systems) would eliminate the PR:L prerequisite and prevent exploitation. Disabling or limiting SMBus-related touchpad functionality via Device Manager is a higher-impact workaround that would trade touchpad usability for attack surface reduction. Driver signature and integrity monitoring (e.g., via Windows Defender Application Control policies) will not prevent exploitation of a signed but vulnerable driver, but can detect unauthorized driver substitution as a secondary control.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today