What is the CVSS score of CVE-2025-26474?

CVE-2025-26474 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openharmony are affected by CVE-2025-26474?

CVE-2025-26474 is a low-severity vulnerability in OpenHarmony involving input validation (CVSS 3.3).

How to fix or mitigate CVE-2025-26474?

During next maintenance window: Apply vendor patches when convenient. Verify input validation controls are in place.

Openharmony CVE-2025-26474

EUVD-2025-208677 LOW

Improper Input Validation (CWE-20)

2026-03-16 OpenHarmony

Information Disclosure Openharmony

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2025-208677

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:10 nvd

LOW 3.3

DescriptionCVE.org

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.

AnalysisAI

OpenHarmony v5.0.3 and prior versions contain an improper input validation vulnerability (CWE-20) that allows a local attacker with limited privileges to read sensitive information from the system. The vulnerability carries a CVSS score of 3.3 with low attack complexity and requires local access and low privileges, indicating a confined risk profile suitable only for restricted exploitation scenarios. While the CVSS vector does not indicate active exploitation or widespread POC availability based on the provided data, the information disclosure impact warrants attention in environments where local privilege escalation chains may amplify the risk.

Technical ContextAI

The vulnerability stems from improper input validation in OpenHarmony, a component-based open-source operating system developed by Huawei. CWE-20 (Improper Input Validation) is the underlying weakness—the system fails to correctly validate, filter, or sanitize user-supplied input before processing, potentially allowing attackers to bypass security controls or access unintended data paths. The affected attack surface is localized to the user/application layer rather than kernel-level or network-facing interfaces, as indicated by the AV:L (Attack Vector: Local) designation in the CVSS vector. The vulnerability does not permit modification (I:N) or denial of service (A:N), limiting the impact to confidentiality breaches (C:L).

RemediationAI

Upgrade OpenHarmony to version 5.0.4 or later once patches are released by the vendor; monitor the official OpenHarmony repository and Huawei security advisories for patch availability and detailed CVE-2025-26474 mitigation guidance. As an interim measure, restrict local user account creation and enforce principle-of-least-privilege (PoLP) on systems running affected versions—disable unnecessary local user accounts, audit and minimize the set of users with shell or application execution privileges, and employ mandatory access controls (MAC) if the OpenHarmony configuration supports SELinux or similar frameworks. In containerized or virtualized deployments, enforce stricter resource and namespace isolation to limit the attack surface for local attackers. Conduct a local threat assessment to identify systems where local attackers are plausible (shared hosting, development environments, compromised endpoints) and prioritize patching in those contexts first.