Huawei HarmonyOS CVE-2025-58288

Requires local access to an affected HarmonyOS device (version 5.0.1 or 5.1.0) with at least low-level privileges (PR:L) - for example, a locally installed or running application or local account able to reach the office service. Exploitation is strictly local (AV:L): there is no remote network path and no user interaction needed once local access is obtained. Limiting factors that reduce real-world risk: the attacker must already have a foothold on the device, only HarmonyOS 5.0.1 and 5.1.0 are listed as affected, and the impact is confined to availability (service/device disruption) with no data exposure or code-integrity compromise.

This is a moderate-severity local denial-of-service issue (CVSS 5.5) in the 'office service' component of Huawei HarmonyOS 5.0.1 and 5.1.0. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the attack is LOCAL (AV:L), requires low privileges (PR:L, i.e. an authenticated local context such as an installed app or local account), needs no user interaction, and impacts only availability (A:H) with no confidentiality or integrity effect. All exploitation signals point to LOW real-world priority rather than an urgent threat: EPSS is 0.09% (0th percentile), there is no CISA KEV listing, and no public exploit code is identified. No SSVC decision data was provided in the input. The CWE-275 (permission issues) classification aligns broadly with a privilege/permission-boundary flaw leading to a crash, though the terse vendor description does not detail the mechanism. Because the vector is local and availability-only with no evidence of exploitation, this is a classic 'moderate CVSS, low real-world urgency' item: relevant for routine patching of affected HarmonyOS devices but not a drop-everything emergency. No conflicting signals between CVSS and description were found (both are consistent with local access).

A malicious or compromised local application running with low privileges on a HarmonyOS 5.0.1 or 5.1.0 device interacts with the office service in a way that triggers an unhandled error or permission-handling flaw, crashing the service and degrading or denying availability. No user interaction is required and no network access is involved. No public proof-of-concept exploit is available at the time of analysis.