Harmonyos CVE-2025-48911

The CVSS 8.2 (High) score reflects significant confidentiality (C:H) and availability (A:H) impact, but several risk signals warrant deeper analysis: (1) The local attack vector (AV:L) and user interaction requirement (UI:R) substantially reduce real-world risk compared to network-based attacks; (2) Scope change (S:C) indicates cross-boundary impact, elevating severity; (3) Absence of confidentiality impact negation and presence of high availability impact suggest DoS or resource exhaustion potential; (4) Without EPSS score, KEV/CISA status, or POC availability, exploitation likelihood is indeterminate—this may be a theoretical high-CVSS issue with low practical exploitability; (5) The ease of exploitation (AC:L) is a positive signal for real-world risk if exposure is present. Recommended approach: Treat as Medium-High priority pending EPSS data and patch availability. Monitor for KEV listing and POC publication as indicators of active exploitation.

A local attacker with standard user privileges on a shared workstation or multi-user system interacts with a note-sharing application (e.g., clicks a malicious link or is socially engineered into modifying a note's sharing settings). Due to improper permission validation in the note sharing module, the attacker can reassign permissions to gain unauthorized read access to confidential notes or modify/delete notes belonging to other users, causing availability impact. The attack requires local code execution context and user interaction (such as clicking a link or opening a crafted file), limiting exposure to insider threats, physical access scenarios, or supply-chain attacks. If a POC exists targeting the permission assignment logic (e.g., API parameter tampering or UI state manipulation), exploitation difficulty is likely low (AC:L), making this a practical risk if the vulnerability is exposed in widely-used collaboration platforms. Cross-scope impact (S:C) means an attacker could potentially affect shared organizational resources or other users' data beyond their own profile.