CVE-2026-80335
Received Received - Intake

Out-of-Bounds Write in Unisoc Bootloader Firmware

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Unisoc

Description
In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-80335
EUVD
EUVD-2026-116698

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80335 is an out-of-bounds write vulnerability in the bootloader download module of Unisoc chipsets. It occurs when a global offset variable is not reset during firmware updates, leading to potential heap memory corruption, system crashes, or arbitrary code execution without requiring additional privileges.

Detection Guidance

Detection requires checking for firmware update failures or heap corruption in bootloader modules. Monitor system logs for crashes during firmware updates and inspect memory dumps for out-of-bounds writes. Use tools like 'strings' or 'hexdump' to analyze bootloader binaries for offset variables that aren't reset.

Impact Analysis

This vulnerability could allow attackers with physical access to corrupt memory, crash the system, or execute arbitrary code on affected devices. It may lead to unauthorized access, data loss, or device malfunction, particularly in mobile devices using Unisoc chipsets.

Mitigation Strategies

Immediately stop all firmware updates until a patch is applied. Contact Unisoc support for updated bootloader versions. Isolate affected devices if physical access is a concern. Monitor for signs of heap corruption or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...