Live › vulnerability › CVE-2026-121803
Unisoc's bulletin (v1.0, 2026-11-01) lists CVE-2026-121803 as an out-of-bounds write in UFS Field Firmware Update code, caused by missing bounds checking on the PRDT table size. It can lead to local code execution or denial of service with no extra privileges. Unisoc rates it High, CVSS 8.8 (AV:L/AC:L/PR:N/UI:N/S:C), though the bulletin text labels the access vector 'Physical'. Who is affected: devices built on Unisoc SoCs with UFS storage; the bulletin's affected-chipsets field is blank and Unisoc says its lists may be incomplete, so exposure cannot be confirmed from public sources. Devices on other vendors' chips or without UFS can skip it. No fixed version or patch level is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 04:46 UTC. All times on this page are UTC.
Devices with UFS storage whose firmware update path (FFU) is exposed to local code. The sources do not name the affected products or versions, so whether a given system is in scope is unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Unisoc UFS firmware (FFU) | vendor | unknown, chipsets not listed | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed.
This page as .md · .json · in your agent: get_signal("CVE-2026-121803")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.