What is the CVSS score of CVE-2025-25277?

CVE-2025-25277 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openharmony are affected by CVE-2025-25277?

Organizations using OpenHarmony should be aware of moderate risk from CVE-2025-25277 rated CVSS 6.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-25277?

Within 30 days: Identify affected systems running OpenHarmony and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openharmony CVE-2025-25277

EUVD-2025-208675 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-16 OpenHarmony

RCE Memory Corruption Openharmony

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2025-208675

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:09 nvd

MEDIUM 6.3

DescriptionCVE.org

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios.

AnalysisAI

This vulnerability allows arbitrary code execution in OpenHarmony pre-installed applications through improper handling of incompatible types, enabling local attackers to escalate privileges and execute arbitrary code within the context of trusted system applications. Affected versions include OpenHarmony v5.0.3 through v5.1.0.x, impacting the core application framework across the OpenHarmony ecosystem. While the CVSS score of 6.3 reflects moderate severity, the vulnerability requires local access and high attack complexity, limiting real-world exploitability to restricted scenarios as noted by the vendor.

Technical ContextAI

The vulnerability stems from CWE-843 (Access of Resource Using Incompatible Type), a type confusion or improper type handling defect in OpenHarmony's application runtime environment. Type confusion vulnerabilities in interpreted or dynamically-typed execution contexts (common in mobile OS application frameworks) allow attackers to bypass type safety checks and access memory regions through unintended interfaces, leading to memory corruption and code execution. The affected CPE (cpe:2.3:a:openharmony:openharmony) indicates this impacts the core OpenHarmony platform, which serves as the runtime environment for all pre-installed and third-party applications. The defect likely exists in the application lifecycle management or inter-process communication (IPC) subsystems where type validation occurs during argument marshaling or parameter passing.

RemediationAI

Upgrade to OpenHarmony versions later than v5.1.0.x immediately; consult the OpenHarmony security disclosure (https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-11.md) for the specific patched version number and release timeline. Until patches can be deployed, restrict local access to OpenHarmony devices to trusted users, disable or isolate pre-installed applications that are not essential, and monitor for suspicious inter-process communication patterns via system audit logs. Organizations should prioritize patching systems where users have local shell access or where multiple untrusted local users may coexist.