Huawei Gallery CVE-2025-58278

Exploitation requires local access to a HarmonyOS 5.0.1 device with low-privilege execution (PR:L) - in practice a malicious or compromised app running on the device - targeting the identity-authentication control within the Gallery app; no user interaction is needed. There is no remote attack surface (AV:L), which is the primary limiting factor: an attacker cannot reach this over the network and must first establish an on-device foothold. Impact is limited to confidentiality (C:H, I:N, A:N), meaning data exposure only, with no modification or disruption. The precise feature/configuration triggering the bypass is not detailed in the available Huawei bulletin reference.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 Medium) describes a locally exploitable flaw requiring low privileges and no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with an authentication bypass that exposes protected data within the Gallery app. The EPSS score is very low (0.11%, 1st percentile), indicating negligible probability of observed exploitation, and the CVE is NOT in CISA KEV; no public exploit (POC) is referenced. All signals align here: this is a real but low-priority confidentiality issue, not a mass-exploitation threat. The AV:L vector means an attacker must already have local access to the device (e.g., a malicious app or physical/on-device foothold), which substantially limits real-world risk. No conflicting signals were found; the only caveat is that the single Huawei bulletin reference is a generic monthly landing page, so the precise exploitation mechanism is not independently detailed.

A malicious or low-privileged app already installed on a HarmonyOS 5.0.1 device abuses an identity-authentication bypass in the Gallery app to access photos or media metadata it should not be permitted to read, breaching the confidentiality of another app or user context on the same device. No public proof-of-concept exploit has been identified, and the attack requires prior local access rather than remote reach.