# CVE-2026-34855: Huawei HarmonyOS and EMUI out-of-bounds write in kernel module

Source: https://junglewise.ai/threats/cve-2026-34855-huawei-harmonyos-and-emui-out-of-bounds-write-in-kernel-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-34855 · Severity: medium · CVSS 5.7 · Published 2026-04-13

A security vulnerability exists in the core software (kernel) of Huawei smartphones and tablets. If exploited, this could allow an attacker to crash the device or access sensitive information that should be protected. This issue affects various versions of HarmonyOS and EMUI software.

## Quick answers

**Is CVE-2026-34855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34855 being exploited in the wild.

**How severe is CVE-2026-34855?** Medium severity, with a CVSS score of 5.7, published 13 April 2026.

**Which products and versions are affected?** Huawei HarmonyOS 4.0.0, 4.2.0, 4.3.0, 4.3.1, 5.1.0, 6.0.0; Huawei EMUI 14.0.0, 14.2.0, 15.0.0.

**Is there a fix for CVE-2026-34855?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-34855 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-34855?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the kernel module of Huawei's HarmonyOS and EMUI operating systems due to improper input validation (CWE-20). The vulnerability is exploitable locally by an attacker with high privileges. Successful exploitation allows the attacker to write data outside the intended buffer boundaries in the kernel, which can lead to a system crash (denial of service) or unauthorized access to sensitive kernel memory (confidentiality impact). The issue is addressed in the April 2026 security update for affected Huawei flagship models.

## Affected products

- Huawei HarmonyOS 4.0.0, 4.2.0, 4.3.0, 4.3.1, 5.1.0, 6.0.0
- Huawei EMUI 14.0.0, 14.2.0, 15.0.0

## Timeline

- 2026-04-13: disclosed
- 2026-04-13: advisory: Huawei published the security bulletin.

## References

- [https://consumer.huawei.com/en/support/bulletin/2026/4/](https://consumer.huawei.com/en/support/bulletin/2026/4/)