Huawei HarmonyOS CVE-2025-58287

Exploitation requires local access to the HarmonyOS device (AV:L) with low-level privileges already granted (PR:L) - specifically the ability to run an app that can invoke the affected office service. No user interaction is needed (UI:N). The limiting factors are substantial: the attacker must already have a foothold on the device as an installed/low-privileged app, exploitation is confined to triggering the use-after-free in the office service, and impact is restricted to confidentiality disclosure only (I:N/A:N) within the same privilege scope (S:U). Affected versions are HarmonyOS 5.0.1 and 5.1.0 per the CPE data.

This is a genuinely moderate, not high-priority, issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable use-after-free in the HarmonyOS office service that an already-present, low-privileged application can trigger to disclose confidential data (C:H) with no impact to integrity or availability. All exploitation signals point the same direction: EPSS is very low at 0.10% (1st percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The local attack vector (AV:L) is the dominant limiting factor: an attacker must already be able to run code on the device, which sharply reduces real-world risk despite the HIGH confidentiality impact. Two data conflicts should be verified: (1) the description states a Use-After-Free, but the assigned CWE-275 is a permissions/privilege-management weakness - the CWE appears mislabeled relative to the described memory-safety flaw; (2) the input Tags include 'Denial Of Service' and 'Microsoft', both of which contradict the actual data (the vector is confidentiality-only with A:N, not a DoS, and the product is Huawei HarmonyOS, not a Microsoft product). Overall this is a real but lower-tier mobile/OS memory-safety bug best handled via routine patching rather than emergency response.

A malicious or compromised low-privileged app installed on a HarmonyOS device invokes the office service in a way that triggers the use-after-free, causing the service to read freed memory and leak sensitive data belonging to the service or other contexts back to the attacker's app. No user interaction is required, but the attacker must already have local code execution on the device. No public proof-of-concept or exploit code was identified in the provided intelligence.