Openharmony CVE-2025-26474

This vulnerability presents a low-to-moderate real-world risk when evaluated holistically. The CVSS score of 3.3 is below the Common Weakness Enumeration's typical severity threshold for widespread concern, and the attack vector (local) with privilege requirement (low) means an attacker already has a foothold on the system. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates this is not a remote unauthenticated attack; it requires local system access and local user privileges. Without evidence of KEV catalog inclusion, active POC exploitation, or high EPSS probability, this appears to be a risk primarily in environments where local attacker presence is plausible—such as shared systems, containers with weak isolation, or post-compromise scenarios. However, in air-gapped or single-user deployments, priority should be lower. Organizations should prioritize this based on their local threat model and whether CWE-20 flaws in this product have historically been chained with privilege escalation exploits.

An unprivileged local user (e.g., a guest account or low-privilege service account) on an OpenHarmony system exploits improper input validation in a system utility or library to craft a malformed input string that bypasses authorization checks and reads sensitive information from memory or files belonging to other users or the system—for example, configuration files containing API keys, authentication tokens, or user data. Given the low attack complexity (AC:L) and the lack of user interaction requirement (UI:N), the attacker can automate this exploitation via a simple script or command-line invocation, making it practical for escalation chains where an initial compromise grants local shell access.