CVE-2026-81647: Huawei HarmonyOS out-of-bounds read in graphics module

Executive brief

An out-of-bounds read vulnerability exists in Huawei HarmonyOS's graphics processing module that could allow an attacker to crash the system or potentially access sensitive memory contents. Exploitation of this flaw may impact system availability and could affect devices running HarmonyOS 6.1.0 across phones, tablets, and PCs.

Technical details

This vulnerability is an out-of-bounds read in the graphics module of HarmonyOS, a component responsible for rendering and displaying visual content. An out-of-bounds read occurs when code attempts to access memory beyond the allocated buffer boundaries, potentially exposing sensitive data or causing a denial of service through system crash. The vulnerability affects HarmonyOS 6.1.0 and likely requires local or adjacent network access to trigger. Successful exploitation may lead to information disclosure or availability impact. Huawei has released security updates addressing this issue as of September 2026.

Affected products

• Huawei HarmonyOS 6.1.0
• Huawei EMUI 16.0.0 and earlier

Timeline

• 2026-09-05: disclosed: Vulnerability listed in Huawei security bulletin
• 2026-09-05: patched: Security update released for HarmonyOS 6.1.0

References

• https://consumer.huawei.com/en/support/bulletin/2026/9/
• https://consumer.huawei.com/en/support/bulletinlaptops/2026/9/