Executive brief
A security flaw has been identified in the contacts application on Huawei mobile devices. This vulnerability could allow an unauthorized person or malicious app to interfere with the normal operation of the contacts service. If exploited, it could lead to service disruptions, potentially preventing users from accessing or managing their contact information.
Technical details
A permission control vulnerability (CWE-840: Business Logic Error) exists within the contacts component of Huawei HarmonyOS. The flaw allows for improper enforcement of access controls, which can be exploited by a local attacker without requiring special privileges or user interaction. Successful exploitation primarily impacts the availability of the service, though the CVSS vector also suggests potential minor impacts on confidentiality and integrity. The vulnerability affects HarmonyOS versions 5.1.0, 6.0.0, and 6.1.0, and has been addressed in the May 2026 security update.
Affected products
- Huawei HarmonyOS 5.1.0, 6.0.0, 6.1.0
Timeline
- 2026-05-07: patched: Huawei released security bulletin for May 2026.
- 2026-05-15: disclosed: NVD publication date.