{"id":"CVE-2026-121803","kind":"vulnerability","aliases":["CVE-2026-121803"],"related":[],"title":"Unisoc UFS firmware update (FFU) flaw: out-of-bounds write can give local code execution or crash","description":"In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed.","summary":"Unisoc's bulletin (v1.0, 2026-11-01) lists CVE-2026-121803 as an out-of-bounds write in UFS Field Firmware Update code, caused by missing bounds checking on the PRDT table size. It can lead to local code execution or denial of service with no extra privileges. Unisoc rates it High, CVSS 8.8 (AV:L/AC:L/PR:N/UI:N/S:C), though the bulletin text labels the access vector 'Physical'. Who is affected: devices built on Unisoc SoCs with UFS storage; the bulletin's affected-chipsets field is blank and Unisoc says its lists may be incomplete, so exposure cannot be confirmed from public sources. Devices on other vendors' chips or without UFS can skip it. No fixed version or patch level is published.","severity":"high","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Unisoc UFS firmware (FFU)","fixed":[],"affected":"unknown, chipsets not listed","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","embedded","firmware","infrastructure","linux-kernel","out-of-bounds-write","ufs","unisoc"],"not_affected_if":[],"how_to_check":"Unisoc lists no affected chipsets for this CVE. Check whether your device uses a Unisoc SoC with UFS storage, then ask the device maker or Unisoc (https://unisupport.unisoc.com) for the affected chipset list and firmware fix. Do not assume the Android Security Bulletin covers it.","fix":null,"status":"open","published_at":"2026-11-04T04:17:33+00:00","first_seen_at":"2026-11-04T04:46:24+00:00","triaged_at":"2026-11-04T04:47:53+00:00","updated_at":"2026-11-04T04:49:32+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T04:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"UFS firmware update flaw lets a local process run code","impact":"high","summary":"The UFS Field Firmware Update (FFU) code is missing a bounds check on the PRDT table size, which allows an out-of-bounds write. A local attacker can use it to run code or crash the device, with no extra privileges needed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ufs","android","embedded","linux-kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local code runs with kernel-level access on the device","analyst_note":"Find the affected product list and vendor patch level for CVE-2026-121803 from the NVD entry and the vendor bulletin.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Devices with UFS storage whose firmware update path (FFU) is exposed to local code. The sources do not name the affected products or versions, so whether a given system is in scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000619,"input_tokens":4108,"output_tokens":417,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected product list and vendor patch level for CVE-2026-121803 from the NVD entry and the vendor bulletin.","search":"'-01':49B '-11':48B '-121803':21A,24A,53B '-2026':20A,23A,52B '2026':47B '8.8':97B 'access':110B 'addit':207C 'affect':115B,128B 'affected-chipset':127B 'android':29B 'av':98B 'blank':132B 'bound':10A,39B,59B,70B,182C,187C 'built':117B 'bulletin':45B,106B,125B 'c':103B 'cannot':143B 'caus':67B 'check':71B,188C 'chip':153B 'chipset':129B 'code':15A,66B,82B,199C 'confirm':145B 'could':195C 'crash':18A 'cve':19A,22A,51B 'cvss':96B 'denial':85B,202C 'devic':116B,149B 'due':184C 'embed':30B 'execut':16A,83B,200C,208C 'exposur':142B 'extra':90B 'ffu':5A,28A,173C 'field':63B,130B,170C 'firmwar':3A,31B,64B,171C 'firmware':27A 'fix':161B 'flaw':6A 'function':174C 'give':13A 'high':95B 'incomplet':140B 'infrastructur':32B 'kernel':35B 'l/ac':99B 'l/pr':100B 'label':108B 'lead':79B,196C 'level':165B 'linux':34B 'linux-kernel':33B 'list':50B,137B 'local':14A,81B,198C 'may':138B 'miss':69B,186C 'n/s':102B 'n/ui':101B 'need':210C 'out-of-bound':7A,56B,179C 'out-of-bounds-writ':36B 'patch':164B 'physic':112B 'possibl':178C 'prdt':74B,191C 'privileg':91B,209C 'public':147B 'publish':167B 'rate':93B 'say':135B 'servic':87B,204C 'size':76B,193C 'skip':158B 'soc':120B 'sourc':148B 'storag':123B 'tabl':75B,192C 'text':107B 'though':104B 'uf':2A,41B,62B,122B,156B,169C 'ufs':26A 'unisoc':1A,25A,42B,43B,92B,119B,134B 'updat':4A,65B,172C 'v1.0':46B 'vector':111B 'vendor':152B 'version':162B 'without':155B 'write':11A,40B,60B,183C","nicknames":[],"mitigations":[],"who_affected":"Devices with UFS storage whose firmware update path (FFU) is exposed to local code. The sources do not name the affected products or versions, so whether a given system is in scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ufsfirmwareffu","unisocufsfirmwareffu"],"ptokens":["ffu","firmware","ufs","unisoc"],"labels":["android","embedded","firmware","high","infrastructure","linuxkernel","outofboundswrite","ufs","unisoc"],"campaign_type":null,"first_public_at":"2026-11-04T04:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@unisoc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121803","severity":null,"published_at":"2026-11-04T04:17:33+00:00","modified_at":"2026-11-04T04:17:33+00:00","first_seen_at":"2026-11-04T04:46:24+00:00","fetched_at":"2026-11-04T04:46:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121803:1631","url":null,"severity":null,"published_at":"2026-11-04T04:49:32+00:00","modified_at":"2026-11-04T04:49:32+00:00","first_seen_at":"2026-11-04T04:49:32+00:00","fetched_at":"2026-11-04T04:49:32+00:00","note":"Read Unisoc bulletin: CVE-2026-121803 chipset list blank, no fix/patch level published; NVD page returned nothing, OpenCVE copies the Unisoc text. Severity lowered critical->high to match the vendor's High 8.8. Nov 2026 Android bulletin (truncated read) not confirmed to include it. QEMU hw/ufs patches in search results are unrelated. X not checked. Nothing marked verified."}],"documents":[{"id":64221,"url":"https://www.unisoc.com/en/support/product-security-bulletin/2117818023857520641","title":"Unisoc Product Security Bulletin (version 1.0, 2026-11-01)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":64225,"url":"https://app.opencve.io/cve/CVE-2026-121803","title":"OpenCVE: CVE-2026-121803","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}