CVE-2026-121803 in Storage
Summary
by MITRE • 11/04/2026
In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The Universal Flash Storage specification defines several mechanisms for updating firmware, including Field Firmware Update which allows for in-situ updates without requiring a full device replacement. Within this architecture, the Protocol Runtime Data Table serves as a critical data structure used to describe scatter-gather lists of buffers involved in command execution between the host and the storage controller. The vulnerability described stems from an implementation flaw where the system fails to validate the size or length field associated with this PRDT table before processing it. This absence of rigorous bounds checking creates a classic buffer overflow scenario, specifically categorized under CWE-787 as an out-of-bounds write. When a malicious actor provides a crafted request that specifies a PRDT size exceeding the allocated memory space for the descriptor structure, the system writes data beyond the intended boundaries into adjacent memory regions.
This technical flaw has severe operational implications because it allows for arbitrary code execution or denial of service conditions without requiring elevated privileges on the host system. Since UFS interfaces are often exposed to various peripherals and potentially untrusted devices in mobile and embedded environments, an attacker with physical access or network-level proximity can exploit this weakness by sending specially crafted commands that trigger the out-of-bounds write. The immediate consequence is memory corruption which can overwrite function pointers, return addresses, or other critical control data structures within the kernel space of the host operating system. This aligns closely with MITRE ATT&CK techniques related to privilege escalation and local code execution via buffer overflow vulnerabilities, enabling an attacker to gain full control over the affected device's firmware stack.
The impact extends beyond simple application crashes because UFS controllers often operate at a low level within the hardware abstraction layer. Successful exploitation can lead to persistent compromise of the storage subsystem itself, potentially allowing for data exfiltration or tampering with stored information before it is even written to non-volatile memory. Furthermore, denial of service conditions may arise if the corruption causes the system kernel to panic or halt operations entirely, rendering the device unusable until a reboot occurs. In mobile devices and IoT systems where these components are prevalent, such vulnerabilities represent significant risks to both data integrity and user privacy due to the deep access level granted by firmware-level execution capabilities.
Mitigation strategies must focus on implementing strict input validation at every stage of command processing within the UFS driver stack. Developers should enforce rigorous checks that verify the PRDT size against predefined maximum limits derived from hardware specifications before allocating memory or initiating data transfers. Additionally, employing compiler-based protections such as stack canaries and address space layout randomization can help mitigate exploitation attempts by making it harder for attackers to predict target addresses in memory. Regular security audits of storage controller drivers are essential to identify similar missing validation patterns across other descriptor tables. Updating firmware to versions that include these patches is the primary remediation step, alongside ensuring that host-side software also validates incoming commands from peripheral devices before passing them down to the hardware interface layer.