Harmonyos CVE-2025-48903

This vulnerability presents a moderate-to-high real-world risk despite some conflicting signals. CVSS 7.8 indicates High severity with local attack vector and low complexity, making it relatively straightforward to exploit once access to the target system is obtained. The requirement for user interaction (UI:R) and local access slightly reduces the attack surface compared to network-exploitable vulnerabilities. However, the high impact ratings for confidentiality (H), integrity (H), and availability (H) in the CVSS vector contradict the stated impact of 'availability only,' suggesting potential for lateral movement or privilege escalation. Without EPSS scores, KEV status, or active exploitation data provided, this should be treated as a credible privilege escalation vector particularly for multi-user systems, shared hosting environments, or scenarios where initial local access has already been compromised. The discrepancy between the description (availability impact) and CVSS vector (full C/I/A impact) warrants immediate investigation and patching.

An attacker with local system access (or who has socially engineered a legitimate user) interacts with the media library module through a user interface that requires their interaction (UI:R). The attacker crafts a request (such as opening a specially formatted media file or clicking a malicious link within the application) that bypasses permission checks due to CWE-264 authentication flaws. Because privilege requirement is None (PR:N), the attacker needs no special privileges—a standard user account suffices. Upon successful exploitation, the attacker gains unauthorized access to protected media assets, potentially reading confidential documents, modifying or deleting media files, and disrupting availability of the media library service. In a multi-user environment, this could escalate to reading colleagues' private files or deleting critical media assets. The low attack complexity (AC:L) means the exploit likely doesn't require complex techniques or timing, making it accessible to less sophisticated threat actors.