Executive brief
A security vulnerability exists in the package management module of Huawei HarmonyOS, which is responsible for installing and managing applications on devices like smartphones, laptops, and smartwatches. An attacker could exploit this flaw to compromise the integrity of system services. This could lead to unauthorized changes to system settings or the disruption of normal device operations.
Technical details
A use-after-free (UAF) vulnerability exists within the package management module of Huawei HarmonyOS. The flaw is categorized under improper access control (CWE-284) and is triggered when the system incorrectly handles memory pointers after they have been freed. An attacker with high privileges and local access can exploit this vulnerability, though the attack complexity is high. Successful exploitation allows the attacker to compromise service integrity and potentially impact confidentiality and availability. The vulnerability is addressed in the June 2026 security update for affected Huawei devices.
Affected products
- Huawei HarmonyOS 6.1.0
Timeline
- 2026-06-05: patched: Huawei released the security bulletin update.
- 2026-06-09: disclosed: NVD published the CVE record.