Executive brief
A logic bypass vulnerability exists in the file system of Huawei HarmonyOS devices, including smartphones, tablets, and PCs. An attacker with physical access to the device could exploit this flaw to disrupt the availability of the system or its data. This could lead to temporary service outages or the inability to access files on the affected device.
Technical details
A logic bypass vulnerability (CWE-606: Unchecked Input for Loop Condition) exists in the file system component of Huawei HarmonyOS. The vulnerability is triggered by improper handling of input that influences loop conditions within the file system logic. According to the CVSS vector, the attack requires physical access (AV:P) to the device but no prior privileges or user interaction. Successful exploitation allows an attacker to impact the availability of the system, likely through a denial-of-service condition or file system corruption. The issue is addressed in the June 2026 security updates for HarmonyOS versions 5.1.0, 6.0.0, and 6.1.0.
Affected products
- Huawei HarmonyOS 5.1.0, 6.0.0, 6.1.0
Timeline
- 2026-06-05: advisory: Huawei published security bulletin
- 2026-06-09: disclosed: NVD publication date