Out-of-Bounds Write Vulnerability in UFS Field Firmware Update by Unisoc
CVE-2026-121803

8.8HIGH

Key Information:

Vendor

Unisoc (shanghai) Technologies Co., Ltd.

Status
Storage
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121803?

A significant vulnerability exists in the UFS Field Firmware Update (FFU) functionality due to inadequate bounds checking on the PRDT table size. This flaw can lead to potential local code execution or denial of service, as it allows attackers to manipulate the data beyond the intended limits, requiring no additional privileges. This vulnerability necessitates immediate attention and remediation to safeguard the integrity of affected systems.

Affected Version(s)

Storage = unspecified

References

https://www.unisoc.com/en/support/product-security-bullet...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.