---
id: "CVE-2026-121803"
kind: "vulnerability"
aliases: ["CVE-2026-121803"]
title: "Unisoc UFS firmware update (FFU) flaw: out-of-bounds write can give local code execution or crash"
severity: "high"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Unisoc UFS firmware (FFU)", "fixed": [], "affected": "unknown, chipsets not listed", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "embedded", "firmware", "infrastructure", "linux-kernel", "out-of-bounds-write", "ufs", "unisoc"]
not_affected_if: []
published_at: "2026-11-04T04:17:33+00:00"
first_seen_at: "2026-11-04T04:46:24+00:00"
updated_at: "2026-11-04T04:49:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121803", "first_seen_at": "2026-11-04T04:46:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T04:49:32+00:00"}]
---

# Unisoc UFS firmware update (FFU) flaw: out-of-bounds write can give local code execution or crash

Unisoc's bulletin (v1.0, 2026-11-01) lists CVE-2026-121803 as an out-of-bounds write in UFS Field Firmware Update code, caused by missing bounds checking on the PRDT table size. It can lead to local code execution or denial of service with no extra privileges. Unisoc rates it High, CVSS 8.8 (AV:L/AC:L/PR:N/UI:N/S:C), though the bulletin text labels the access vector 'Physical'. Who is affected: devices built on Unisoc SoCs with UFS storage; the bulletin's affected-chipsets field is blank and Unisoc says its lists may be incomplete, so exposure cannot be confirmed from public sources. Devices on other vendors' chips or without UFS can skip it. No fixed version or patch level is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Unisoc UFS firmware (FFU) affected unknown, chipsets not listed fixed ?

## How to check

Unisoc lists no affected chipsets for this CVE. Check whether your device uses a Unisoc SoC with UFS storage, then ask the device maker or Unisoc (https://unisupport.unisoc.com) for the affected chipset list and firmware fix. Do not assume the Android Security Bulletin covers it.

## Timeline

- 2026-11-04T04:46:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121803
- 2026-11-04T04:49:32+00:00 analyst — Read Unisoc bulletin: CVE-2026-121803 chipset list blank, no fix/patch level published; NVD page returned nothing, OpenCVE copies the Unisoc text. Severity lowered critical->high to match the vendor's High 8.8. Nov 2026 Android bulletin (truncated read) not confirmed to include it. QEMU hw/ufs patches in search results are unrelated. X not checked. Nothing marked verified.

## Documents

- [advisory] Unisoc Product Security Bulletin (version 1.0, 2026-11-01) https://www.unisoc.com/en/support/product-security-bulletin/2117818023857520641
- [mentions] OpenCVE: CVE-2026-121803 https://app.opencve.io/cve/CVE-2026-121803

## From the sources

In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_