Executive brief
A memory safety vulnerability exists in Huawei HarmonyOS, the operating system used in Huawei smartphones, tablets, and smartwatches. An attacker could exploit this flaw to cause system instability or a denial-of-service condition, potentially rendering the device temporarily unusable. This impact primarily affects the availability of the device and its applications.
Technical details
A boundary-unlimited vulnerability (CWE-119) exists in the application read module of Huawei HarmonyOS 6.0.0. The flaw is characterized as an improper restriction of operations within the bounds of a memory buffer. An attacker with local access can exploit this vulnerability without requiring special privileges or user interaction. Successful exploitation can lead to memory corruption, primarily impacting system availability through crashes or service disruption, and potentially causing minor integrity issues. Patches were released as part of the April 2026 security bulletin.
Affected products
- Huawei HarmonyOS 6.0.0
Timeline
- 2026-04-08: patched: Huawei released security bulletin for wearables
- 2026-04-13: disclosed: CVE published to NVD