What is the CVSS score of CVE-2025-48903?

CVE-2025-48903 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Harmonyos are affected by CVE-2025-48903?

A permission bypass vulnerability in the media library module poses a HIGH risk to organizational operations.

How to fix or mitigate CVE-2025-48903?

Within 24 hours: Inventory all systems using the affected media library module and assess business criticality. Within 7 days: Implement compensating controls including access restrictions to media library functions, enhanced logging of media library activities, and network segmentation where applicable. Within 30 days: Monitor for official patch release from vendor and prepare testing/deployment infrastructure; escalate to vendor for timeline if patch remains unavailable beyond 30 days.

Harmonyos CVE-2025-48903

EUVD-2025-17088 HIGH

Permissions, Privileges, and Access Controls (CWE-264)

2025-06-06 psirt@huawei.com

Privilege Escalation Harmonyos

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17088

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 07:15 nvd

HIGH 7.8

DescriptionCVE.org

Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

Permission bypass vulnerability in the media library module that allows unauthenticated local attackers to escalate privileges and gain unauthorized access to sensitive functionality. The vulnerability has a CVSS score of 7.8 (High) and impacts confidentiality, integrity, and availability. While the description indicates only availability impact, the CVSS vector reveals high C/I/A ratings, suggesting attackers can read, modify, or delete protected media assets and potentially disrupt service availability.

Technical ContextAI

This vulnerability is classified as CWE-264 (Use of Improper Authentication), indicating a fundamental flaw in the media library module's permission validation mechanism. The module likely fails to properly authenticate or authorize user requests before granting access to protected media resources. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates this is a local attack vector requiring user interaction but no privileges, suggesting the vulnerability may be triggered through social engineering or by convincing a user to open a malicious file or link. The root cause involves improper access control checks when processing media library operations, allowing bypass of intended permission boundaries. Without specific CPE data provided, the affected component is generically identified as a media library module within an unspecified application or platform.

RemediationAI

Without vendor-specific patch information provided in the source data, remediation should follow this general approach: (1) Identify all instances of affected media library modules in your environment; (2) Contact the vendor for patch availability and timelines; (3) Apply available security patches immediately to all affected versions; (4) If patches are unavailable, implement access controls restricting local user access to the media library module; (5) Implement file integrity monitoring on media storage directories; (6) Audit permission settings on all media assets to ensure proper access controls; (7) Monitor user activity logs for unauthorized media access attempts. Organizations should subscribe to vendor security bulletins for CVE-2025-48903 patch availability notifications.