EUVD-2025-208675Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk profile presents mixed signals that suggest this is a real but contained vulnerability. The CVSS 6.3 (Medium) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N indicates attack requires local access (AV:L), high complexity (AC:H), and low privileges (PR:L), while delivering high confidentiality and integrity impact but no availability impact. The restriction to 'pre-installed apps' and vendor statement that it can only be exploited 'in restricted scenarios' significantly reduces EPSS probability compared to the base CVSS, suggesting exploitation is feasible only under narrow conditions (specific system state, specific app interactions, or specific device configurations). The absence of documented KEV/public POC and the requirement for local access plus high complexity make this a lower priority than the CVSS alone suggests, though organizations running OpenHarmony should still prioritize timely patching due to the high confidentiality and integrity impact when exploitation is possible. |
| Exploit ScenarioDerived | An authenticated local user on an OpenHarmony device (e.g., a secondary user account or a developer with shell access) crafts a malformed IPC message or application parameter that triggers type confusion in the pre-installed app runtime environment. By sending incompatible type data through the vulnerable interface, the attacker bypasses type safety checks and causes memory corruption, allowing them to write code into executable memory or hijack function pointers, ultimately achieving arbitrary code execution with the privileges of the pre-installed application. This scenario assumes the attacker can interact with specific vulnerable code paths and requires detailed knowledge of the runtime's memory layout, explaining the 'high attack complexity' and restriction to 'specific scenarios.' |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
This vulnerability allows arbitrary code execution in OpenHarmony pre-installed applications through improper handling of incompatible types, enabling local attackers to escalate privileges and execute arbitrary code within the context of trusted system applications. Affected versions include OpenHarmony v5.0.3 through v5.1.0.x, impacting the core application framework across the OpenHarmony ecosystem. While the CVSS score of 6.3 reflects moderate severity, the vulnerability requires local access and high attack complexity, limiting real-world exploitability to restricted scenarios as noted by the vendor.
RemediationAI
Upgrade to OpenHarmony versions later than v5.1.0.x immediately; consult the OpenHarmony security disclosure (https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-11.md) for the specific patched version number and release timeline. Until patches can be deployed, restrict local access to OpenHarmony devices to trusted users, disable or isolate pre-installed applications that are not essential, and monitor for suspicious inter-process communication patterns via system audit logs. Organizations should prioritize patching systems where users have local shell access or where multiple untrusted local users may coexist.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-843 (Access of Resource Using Incompatible Type), a type confusion or improper type handling defect in OpenHarmony's application runtime environment. Type confusion vulnerabilities in interpreted or dynamically-typed execution contexts (common in mobile OS application frameworks) allow attackers to bypass type safety checks and access memory regions through unintended interfaces, leading to memory corruption and code execution. The affected CPE (cpe:2.3:a:openharmony:openharmony) indicates this impacts the core OpenHarmony platform, which serves as the runtime environment for all pre-installed and third-party applications. The defect likely exists in the application lifecycle management or inter-process communication (IPC) subsystems where type validation occurs during argument marshaling or parameter passing.
Know when Openharmony gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios.
Executive ViewAI
Organizations using OpenHarmony should be aware of moderate risk from CVE-2025-25277 rated CVSS 6.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in OpenHarmony Local Privilege Escalation
View all 4More in Openharmony
View allin OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through
Arbitrary code execution in OpenHarmony v6.0 and earlier enables remote attackers with low privileges to execute code wi
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sens
in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through improper in
in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after f
in OpenHarmony v4.0.0 and prior versions allow an adjacent attacker arbitrary code execution in any apps through use aft
OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softb
OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. Rated high severity (CVSS 8.8), this vulne
GitHub PoC
Exploit-DB