Huawei HarmonyOS CVE-2025-58289
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run local app with low privileges
-
ExploitInvoke print module with malformed input
-
ExecutionTrigger improper exception handling
-
ImpactCrash module, deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Business logic errors
|
| Exploitation Conditions | Exploitation requires local access to a HarmonyOS 5.0.1 or 5.1.0 device with existing low-level privileges (PR:L) - in practice a locally-installed or already-running application that can reach the print module. The attacker must supply input that the print module's exception handling fails to process correctly (CWE-840). Limiting factors: no remote network vector (AV:L), the attacker must already have a foothold with low privileges on the device, and impact is confined to availability (a crash/DoS of the print functionality) with no data exposure or code integrity loss; no user interaction is required (UI:N). |
| Impact | This is a moderate-severity, low-priority issue. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-exploitable availability-only flaw: the attacker needs local access and low-level privileges (PR:L), consistent with a malicious or compromised application on the device rather than a remote attacker. All exploitation signals point AWAY from urgency: EPSS is 0.09% (0th percentile), there is no CISA KEV listing, and no public exploit code is identified. No SSVC decision data was provided. The impact is limited to availability (C:N/I:N/A:H) - likely a crash or denial of service in the print module - with no confidentiality or integrity loss. CONFLICTING SIGNAL: the input Tag 'Information Disclosure' directly contradicts the CVSS vector, which sets C:N (no confidentiality impact); the vulnerability is an availability issue, not disclosure, so that tag appears mislabeled. Overall this is a high-CVSS-relative-to-real-risk item: a local DoS requiring on-device privileges, low exploitation probability, and no evidence of exploitation - routine patch prioritization, not emergency. |
| Exploit ScenarioDerived | A malicious or compromised application already running on a HarmonyOS 5.0.1/5.1.0 device invokes the print module with input that triggers improper exception handling, causing the module or a dependent service to crash and become unavailable. No public exploit code is identified, and the attack requires local access with existing low-level privileges, so there is no remote or unauthenticated path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Improper exception handling in the Huawei HarmonyOS print module leaves HarmonyOS 5.0.1 and 5.1.0 devices open to a local low-privileged attacker - in practice an already-installed or running application that can reach the print service - who can supply crafted input that the module fails to process correctly and thereby crash or disable printing. The impact is availability-only (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5), with no data exposure, privilege escalation, or code-integrity loss reported, and no user interaction is required. No public exploit code has been identified at time of analysis and EPSS is negligible (0.09%, 0th percentile); this is a moderate-severity, low-priority hardening issue rather than an active threat.
RemediationAI
Apply the HarmonyOS security update referenced in Huawei's October 2025 consumer bulletin (https://consumer.huawei.com/en/support/bulletin/2025/10/); the provided intelligence does not state an exact fix version string, so verify the patched build number directly in the vendor advisory and update affected HarmonyOS 5.0.1 and 5.1.0 devices to it. Because a fix version is not independently confirmed in the supplied data, treat the vendor bulletin as the definitive patch-status source rather than assuming an unpatched state. Until devices are updated, the practical compensating controls all follow from the fact that exploitation requires a locally-installed, low-privileged app (AV:L/PR:L): restrict installation to trusted, vetted app sources and Huawei AppGallery so a malicious app cannot obtain a foothold in the first place (trade-off: reduced sideloading flexibility); review and revoke unnecessary application permissions, particularly anything granting access to printing or print-service interfaces, for untrusted apps (trade-off: may break legitimate print-app functionality); and disable or remove the print service/spooler on devices that do not require printing (trade-off: loses all printing capability). Monitor device logs for repeated abnormal termination of the print service as a possible indicator of attempted exploitation, and note that no remote or unauthenticated attack path applies, so perimeter controls are not relevant here.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in the print module of Huawei's HarmonyOS (a Huawei-proprietary, microkernel-based mobile/embedded operating system used across phones, tablets, and IoT devices) and maps to CWE-840, the business-logic-error class, reflecting that the weakness is in the module's own control/exception-flow logic rather than a memory-safety defect such as a buffer overflow. The description specifies improper exception handling, meaning malformed or unexpected input reaching the print subsystem is not caught and handled gracefully, causing the print service to terminate or become unresponsive. The CVSS vector confirms the exploitation model: AV:L (local access to the device), PR:L (the attacker already holds low-level privileges, e.g. a sandboxed app), UI:N (no victim interaction), and an availability-only impact (A:H with C:N/I:N), while CPE identifiers cpe:2.3:o:huawei:harmonyos:5.0.1 and cpe:2.3:o:huawei:harmonyos:5.1.0 pin the affected OS builds precisely. Although the source tags include 'Information Disclosure', the authoritative assessed vector and description indicate availability impact only, so no confidentiality impact should be assumed.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local on-device app with low privileges triggers an unhandled exception (AV:L, PR:L, AC:L); impact is availability-only (A:H, C:N, I:N) with no scope change.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB