Executive brief
A stack overflow vulnerability exists in the media platform of Huawei HarmonyOS devices, including smartphones, tablets, PCs, and smartwatches. If exploited, this flaw could allow an attacker to cause the device to crash or become unresponsive, impacting the availability of media services. This could disrupt normal operations and require a device restart to restore functionality.
Technical details
A stack overflow vulnerability exists in the media platform component of Huawei HarmonyOS 6.0.0. The vulnerability is tracked as CWE-835 (Loop with Unreachable Exit Condition) by the vendor, though described as a stack overflow. An attacker with local access and low privileges could exploit this flaw, likely requiring some form of user interaction, to trigger a crash or exhaustion of system resources. Successful exploitation primarily impacts system availability, though minor impacts to confidentiality and integrity were also noted in vendor metrics. Patches were released as part of the April 2026 security update cycle.
Affected products
- Huawei HarmonyOS 6.0.0
Timeline
- 2026-04-08: patched: Vendor advisory updated with patch information
- 2026-04-13: disclosed: Initial disclosure date
- 2026-04-13: advisory: NVD publication date