Executive brief
A security vulnerability exists in the memo module of Huawei HarmonyOS, which is used for note-taking and organization on smartphones, tablets, and laptops. If exploited, this flaw could allow unauthorized access to sensitive information or cause the application to become unavailable. This could lead to a breach of user privacy or disruption of personal data management.
Technical details
An improper access control vulnerability (CWE-284) exists in the memo module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. The vulnerability is triggered via a local attack vector requiring user interaction and occurs under high-complexity conditions. Successful exploitation allows an attacker to bypass intended access restrictions, potentially leading to unauthorized data disclosure or a denial-of-service state for the affected module. Huawei has addressed this issue in the April 2026 security update.
Affected products
- Huawei HarmonyOS 5.1.0, 6.0.0
Timeline
- 2026-04-08: patched: Huawei released security bulletin for PCs
- 2026-04-13: disclosed: Initial NVD publication date
- 2026-04-16: advisory: NVD last modified with enrichment data