HarmonyOS Gallery CVE-2025-54654

Exploitation requires a local, already-authenticated low-privilege context on the device (PR:L) - in practice a malicious, sideloaded, or over-permissioned app running on an affected HarmonyOS 5.0.1 or 5.1.0 build that invokes the vulnerable Gallery module. The attacker cannot reach this remotely (AV:L) and the flaw only exposes data within the same device (scope Unchanged). Limiting factors: an attacker must first get code running on the device, the impact is confined to confidentiality (reading Gallery media/metadata) with no integrity or availability effect, and only the two named HarmonyOS versions are listed as affected.

This is a moderate-severity, locally-exploitable information disclosure flaw rather than a high-priority emergency. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-resident, low-privileged, no-interaction attack with high confidentiality impact but zero integrity or availability impact - consistent with a malicious or sideloaded app bypassing permission controls to read Gallery data it should not access. The EPSS score is very low (0.09%, 1st percentile), there is no CISA KEV listing and no public exploit identified, so all exploitation signals point to low real-world urgency. Note a classification tension: the tag labels this 'Privilege Escalation' and CWE-264 is a permission/access-control weakness, yet the CVSS impact profile (C:H only, no I/A, scope Unchanged) describes confidentiality disclosure rather than classic privilege elevation - treat this as an access-control/confidentiality bypass rather than full privilege gain. No conflicting data undermines the core picture; the main limitation is the terse one-line Huawei description, which does not specify the exact permission check that fails.

A user installs a malicious or over-reaching third-party application on a HarmonyOS 5.0.1 or 5.1.0 device. Running with its own low-level app privileges and no user interaction, the app abuses the flawed permission control in the Gallery module to read private photos, videos, or associated metadata it was never granted access to. No public exploit code is currently available, and the local attack vector means the attacker must already have code execution on the device.