Openharmony CVE-2025-12736

The CVSS 3.1 score of 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) correctly reflects a medium-to-high risk: local attack vector with low complexity, low privilege requirement, no user interaction needed, and high confidentiality impact across system boundaries. However, this is a pure information disclosure with no integrity or availability impact. Real-world exploitation probability depends on EPSS data (not provided in intelligence), but CWE-908 vulnerabilities typically have moderate-to-high automatable exploit potential once local code execution is achieved. The vulnerability is NOT listed in CISA KEV, suggesting no active in-the-wild exploitation campaigns are currently tracked. The absence of a public proof-of-concept in references limits immediate threat, but the technical simplicity of memory-reading attacks means exploit development is trivial once details are disclosed. Priority should be HIGH for systems processing sensitive data or in multi-tenant environments, but MEDIUM for isolated single-user deployments. This is a legitimate priority issue—not an inflated CVSS score—due to the reliability and automation potential of the attack.

An attacker with local shell access (compromised user account or application vulnerability) executes code that reads uninitialized heap or stack memory regions allocated to other processes or kernel subsystems. By repeatedly triggering allocations or scanning memory, the attacker retrieves case-sensitive secrets such as session tokens, cryptographic material, or user credentials that were not properly cleared during prior deallocations. This requires local code execution but only standard user-level privileges and no user interaction—a realistic scenario in shared mobile devices, IoT systems running OpenHarmony, or cloud VMs where containerization or privilege isolation is incomplete.