Huawei HarmonyOS CVE-2025-58286

Exploitation requires LOCAL access to a Huawei device running HarmonyOS 5.0.1 or 5.1.0 and LOW privileges (PR:L) - i.e., the attacker must already have an on-device foothold such as an installed low-privileged application that can reach the office service. No user interaction is needed (UI:N). It is NOT remotely exploitable (AV:L), which is the primary limiting factor; the attack surface is restricted to processes already running on the device, and impact is limited to loss of office-service availability with no data exposure or modification. The exact feature or input that triggers the fault is not disclosed in the description.

This is a moderate-severity, availability-only denial-of-service issue in the HarmonyOS 'office service' and the multiple signals are consistent in pointing to low real-world urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) shows a LOCAL attack vector requiring LOW privileges, meaning an attacker must already be able to run code or interact with the service on the device - it is not remotely reachable. Impact is confined to availability (A:H) with no confidentiality or integrity effect, which fits a crash/hang DoS. The EPSS score of 0.11% (1st percentile) reinforces very low expected exploitation, and the vulnerability is NOT on the CISA KEV list, so there is no public evidence of active exploitation. No proof-of-concept is referenced. In short: real-world risk is LOW - a locally-exploitable, availability-only bug with no exploitation signals - rather than a high-priority threat. The one caveat is data sparseness: Huawei's description is minimal ('may affect availability') and does not name the exact trigger, so the precise exploitation path cannot be independently confirmed from the provided data.

A malicious or compromised low-privileged local app on a HarmonyOS device invokes the office service with malformed input or an abusive sequence of calls, causing the service to crash or hang and denying office functionality to the user. No public exploit code is referenced, and the local vector means the attacker must already have code execution on the device.