{"id":"CVE-2026-80335","kind":"vulnerability","aliases":["CVE-2026-80335"],"related":[],"title":"Unisoc bootloader out-of-bounds write in firmware download module (CVE-2026-80335)","description":"In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges needed.","summary":"A bootloader download module fails to reset a global offset variable during firmware update sessions, which can cause an out-of-bounds write into heap memory. An attacker may corrupt memory, crash the system, or run arbitrary code without extra privileges.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Unisoc bootloader (download module)","fixed":["Android security patch level 2026-11-05"],"affected":"chipsets SC9863A, SC9832E, SC7731E, T310, T610, T618, T7200, T7225, T7250, T7255, T7280, T8100, T9100, T8200, T7300, T8300 (list may be incomplete)","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","bootloader","embedded","firmware","infrastructure","physical-access","unisoc"],"not_affected_if":["non-unisoc-chipset"],"how_to_check":"Find out if your device uses one of the affected Unisoc chipsets (SC9863A, SC9832E, SC7731E, T310, T610, T618, T7200, T7225, T7250, T7255, T7280, T8100, T9100, T8200, T7300, T8300); on Android check Settings > About phone > Security patch level is 2026-11-05 or later. Unisoc says the chipset list may be incomplete.","fix":"Android devices: install security patch level 2026-11-05 or later (per Android bulletin entry on OSV). Other devices: get a firmware update from your device maker; Unisoc gives no fixed version.","status":"open","published_at":"2026-11-04T04:17:37+00:00","first_seen_at":"2026-11-04T04:46:24+00:00","triaged_at":"2026-11-04T04:47:53+00:00","updated_at":"2026-11-04T04:49:13+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-04T04:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Bootloader firmware download module: out-of-bounds write allows code execution","impact":"high","summary":"A bootloader download module fails to reset a global offset variable during firmware update sessions, which can cause an out-of-bounds write into heap memory. An attacker may corrupt memory, crash the system, or run arbitrary code without extra privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["firmware","bootloader","embedded"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary code runs on the device after heap memory corruption","analyst_note":"Identify the affected product and vendor advisory for CVE-2026-80335 from the NVD entry, then fill in affected versions and fixes.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected device or vendor, only a bootloader download module used during firmware update sessions. Teams running devices with firmware update functionality should look for a vendor advisory matching this CVE. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":4107,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor advisory for CVE-2026-80335 from the NVD entry, then fill in affected versions and fixes.","search":"'-2026':13A,16A,19A '-80335':14A,17A,20A 'access':32B 'addit':120C 'android':25B 'arbitrari':71B,115C 'attack':62B 'bootload':2A,26B,35B,78C 'bootloader':22A 'bound':6A,56B,88C 'caus':51B 'code':72B,116C 'corrupt':64B,110C 'could':105C 'crash':66B,112C 'cve':12A,15A,18A 'download':10A,23A,36B,79C 'due':90C 'embed':27B 'execut':117C,121C 'extra':74B 'fail':38B 'failur':93C 'firmwar':9A,28B,46B,101C 'global':42B,97C 'heap':59B,108C 'infrastructur':29B 'lead':106C 'may':63B 'memori':60B,65B,109C 'modul':11A,37B,80C 'module':24A 'need':123C 'offset':43B,98C 'out-of-bound':3A,53B,85C 'physic':31B 'physical-access':30B 'possibl':84C 'potenti':114C 'privileg':75B,122C 'reset':40B,95C 'run':70B 'session':48B,103C 'system':68B,111C 'unisoc':1A,21A,33B 'updat':47B,102C 'variabl':44B,99C 'without':73B 'write':7A,57B,89C","nicknames":[],"mitigations":[],"who_affected":"Devices built on the listed Unisoc chipsets (budget phones, tablets, embedded and IoT devices). Unisoc rates the access vector as physical, so an attacker needs hands-on access (for example via the firmware download path) rather than network reach. Device makers get fixes from Unisoc and ship them; everyone else can skip it if their device does not use these chipsets.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bootloaderdownloadmodule","unisocbootloaderdownloadmodule"],"ptokens":["bootloader","download","module","unisoc"],"labels":["android","bootloader","embedded","firmware","high","infrastructure","physicalaccess","unisoc"],"campaign_type":null,"first_public_at":"2026-11-04T04:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@unisoc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-80335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80335","severity":null,"published_at":"2026-11-04T04:17:37+00:00","modified_at":"2026-11-04T04:17:37+00:00","first_seen_at":"2026-11-04T04:46:24+00:00","fetched_at":"2026-11-04T04:46:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-80335:1632","url":null,"severity":null,"published_at":"2026-11-04T04:49:13+00:00","modified_at":"2026-11-04T04:49:13+00:00","first_seen_at":"2026-11-04T04:49:13+00:00","fetched_at":"2026-11-04T04:49:13+00:00","note":"Unisoc bulletin (2026-11-01) names 16 affected chipsets, physical access vector, CVSS 8.4; no fix version in vendor page. OSV/Android entry ASB-A-553139427 lists SPL 2026-11-05 as fixed (secondary, not verified). Not exploited, no PoC found."}],"documents":[{"id":64221,"url":"https://www.unisoc.com/en/support/product-security-bulletin/2117818023857520641","title":"Unisoc Product Security Bulletin (version 1.0, 2026-11-01)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":64222,"url":"https://osv.dev/vulnerability/ASB-A-553139427","title":"OSV ASB-A-553139427 (Android bulletin entry for CVE-2026-80335)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}