What is the CVSS score of CVE-2025-52458?

CVE-2025-52458 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openharmony are affected by CVE-2025-52458?

Organizations using OpenHarmony should be aware of moderate risk from CVE-2025-52458, a out-of-bounds write vulnerability rated CVSS 5.5.

How to fix or mitigate CVE-2025-52458?

Within 30 days: Identify affected systems running OpenHarmony and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openharmony CVE-2025-52458

EUVD-2025-208681 MEDIUM

Out-of-bounds Write (CWE-787)

2026-03-16 OpenHarmony

RCE Buffer Overflow Memory Corruption Openharmony

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2025-208681

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:10 nvd

MEDIUM 5.5

DescriptionCVE.org

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.

AnalysisAI

An out-of-bounds write vulnerability (CWE-787) exists in OpenHarmony versions up to and including v5.1.0, enabling local attackers to execute arbitrary code within pre-installed applications. The vulnerability requires local access and low privileges but can result in complete confidentiality compromise. This is a memory corruption issue that, while restricted to specific scenarios, poses a meaningful risk to OpenHarmony device security given the local attack vector and high impact on confidentiality.

Technical ContextAI

OpenHarmony is an open-source operating system (identified via CPE cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*) designed for IoT and embedded devices. The vulnerability stems from a CWE-787 (Out-of-bounds Write) condition in memory-handling routines, likely within system libraries or kernel components used by pre-installed applications. Out-of-bounds writes are classic buffer overflow memory corruption issues that allow attackers to overwrite adjacent memory structures, potentially hijacking control flow or modifying sensitive data. The restriction to pre-installed apps and specific scenarios suggests the vulnerability exists within a sandboxed or capability-gated code path rather than in universally accessible kernel code, limiting but not eliminating exploitability.

RemediationAI

Upgrade OpenHarmony to a patched version beyond v5.1.0.x as released by the OpenHarmony project. Consult the official security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-10.md for specific patch availability and timelines. Until patching is feasible, implement the following mitigations: (1) restrict local user account creation and access on OpenHarmony devices to trusted personnel only, reducing the likelihood of local attacker scenarios; (2) isolate OpenHarmony devices on network segments with restricted outbound access to limit lateral movement if code execution is achieved; (3) monitor process behavior in pre-installed applications for anomalies or unexpected memory access patterns. Prioritize patching for high-risk deployments (connected home devices, medical IoT, industrial controllers).