Executive brief
A security vulnerability exists in the card module of Huawei HarmonyOS, which is used for managing interactive interface components on smartphones, tablets, and PCs. If exploited, this flaw could allow an attacker to bypass security permissions, potentially leading to service disruptions or making the device's features unavailable. Users are advised to update their devices to the latest security patch level provided in the July 2026 update.
Technical details
A permission bypass vulnerability exists in the card module of Huawei HarmonyOS version 6.1.0. The flaw is classified under CWE-264 (Permissions, Privileges, and Access Controls) and stems from improper enforcement of access restrictions within the module. An attacker with local access could exploit this vulnerability, though it requires user interaction (UI:R) to succeed. Successful exploitation allows the attacker to bypass intended security controls, primarily impacting the availability of the affected component or service, with minor impacts on confidentiality and integrity. Huawei has addressed this in the July 2026 security bulletin.
Affected products
- Huawei HarmonyOS 6.1.0
Timeline
- 2026-07-08: other: Advisory last updated by vendor
- 2026-07-15: disclosed: NVD publication date