What is the CVSS score of CVE-2025-12736?

CVE-2025-12736 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openharmony are affected by CVE-2025-12736?

Organizations using OpenHarmony should be aware of notable risk from CVE-2025-12736 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-12736?

Within 30 days: Identify affected systems running OpenHarmony and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openharmony CVE-2025-12736

EUVD-2025-208673 MEDIUM

Use of Uninitialized Resource (CWE-908)

2026-03-16 OpenHarmony

Information Disclosure Openharmony

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2025-208673

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:09 nvd

MEDIUM 6.5

DescriptionCVE.org

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.

AnalysisAI

OpenHarmony versions 5.0.3 and earlier contain an information disclosure vulnerability caused by use of uninitialized resources, allowing local attackers to leak sensitive case-sensitive data. The vulnerability affects OpenHarmony deployments across all product lines up to v5.0.3.x (per EUVD-2025-208673). An attacker with local access and standard user privileges can read uninitialized memory regions to obtain confidential information without requiring user interaction, though there is no indication of active exploitation in public KEV databases at this time.

Technical ContextAI

The vulnerability is rooted in CWE-908 (Use of Uninitialized Resource), a memory safety issue where uninitialized variables or heap/stack regions retain sensitive data from prior allocations. In the OpenHarmony operating system (as confirmed by CPE cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*), resource initialization routines fail to properly zero or sanitize memory before allocation to user-space processes. This allows local processes to read residual data containing case-sensitive information such as encryption keys, authentication tokens, or other secrets that were previously stored in that memory. The attack requires local code execution capability but no special privileges beyond standard user-level access, making it a practical concern in multi-tenant or shared-device scenarios.

RemediationAI

Upgrade OpenHarmony to version 5.0.4 or later once released by the vendor; check the official OpenHarmony security advisory at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-12.md for patch availability and timeline. Until patches can be deployed, implement local access controls by restricting shell access and application execution privileges using OpenHarmony's Discretionary Access Control (DAC) or mandatory access control mechanisms, disable inter-process memory sharing where possible, and enforce strong authentication for local system access. For sensitive deployments, consider network isolation of affected systems until patches are confirmed and tested in your environment.