Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82876Phison PS3111-S11 Controller Firmware Signature Verification Bypass

High 8.2

In plain English

A high-severity security flaw in PS3111-S11 Controller Firmware from Phison Electronics Corporation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.1%top 98.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.

Affected products (as reported)

Vendor	Product	Versions
Phison Electronics Corporation	PS3111-S11 Controller Firmware	SBFQT1.3

Weakness: CWE-347 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://trulycrisp.github.io/drivefirmware/phison_s11/ technical-description
https://github.com/trulycrisp/psychite exploit
VulnCheck Advisory: Phison PS3111-S11 Controller Firmware Signature Verification Bypass third-party-advisory