Openharmony CVE-2025-41432

The CVSS v3.1 score of 5.5 reflects a medium-severity vulnerability with a local attack vector (AV:L), low complexity (AC:L), and low privilege requirements (PR:L), but it grants only confidentiality impact (C:H) and no integrity or availability impact in the base vector—suggesting the CVSS may underestimate code execution risk. However, the vulnerability's real-world risk is moderated by several factors: it requires local attacker presence, operates under restricted exploitation scenarios as explicitly noted in the description, and has not been observed in active KEV exploitation campaigns to date. The availability of detailed disclosure documentation (EUVD-2025-208679 and OpenHarmony security advisory) indicates transparent vendor communication but also increases awareness among potential adversaries. From an SSVC perspective, exploitation is plausible but not yet widespread, technical impact is high (arbitrary code execution in privileged context), and the automatable nature of memory exploits is concerning. This should be prioritized for patching in environments running OpenHarmony-based devices, particularly in IoT, embedded, and mobile deployments, but it does not pose immediate critical risk to organizations without deployed OpenHarmony infrastructure.

An attacker with local user-level access on an OpenHarmony-based device (such as a compromised application or local shell access) crafts a malicious input or triggers a specific code path in a pre-installed application that processes untrusted data without proper bounds checking. This causes an out-of-bounds write to adjacent memory regions, overwriting function pointers or return addresses. The attacker then achieves code execution within the context of the pre-installed application—potentially with elevated privileges if the application runs as root or a system service—allowing exfiltration of sensitive data or further lateral movement on the device. The restricted exploitation scenario suggests the attack path may require specific device configurations, timing conditions, or application states.