HarmonyOS Office Service CVE-2025-58290

Exploitation requires local access to the HarmonyOS device (AV:L) with at least low-level privileges already granted (PR:L) - in practice a locally running application or process on HarmonyOS 5.0.1 or 5.1.0 that can reach the office service. No user interaction is needed (UI:N), and impact is limited strictly to availability of the office service (A:H, with C:N/I:N). Limiting factors: the attacker cannot exploit this remotely over the network, must already possess code execution/privileges on the device, and gains no data access or code integrity impact - only a service disruption. Affected scope is confined to the two named HarmonyOS versions.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency, and the available signals are largely consistent on that point. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 (Medium): exploitation requires local access with at least low-level privileges already on the device, no user interaction, and the only impact is to availability (C:N/I:N) - a denial of service against the 'office service,' with no confidentiality or integrity loss and no scope change. The EPSS score of 0.11% (1st percentile) reinforces very low likelihood of widespread exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public evidence of active exploitation or weaponization. The local attack vector plus required privileges substantially constrain real-world risk: an attacker must already have a foothold (e.g., a malicious or compromised app) on the HarmonyOS device. One data caveat: the assigned weakness is CWE-41 (Improper Resolution of Path Equivalence), which is an unusual mapping for a pure availability/DoS issue - verify the CWE with the vendor, as it may indicate a path-handling bug manifesting as a crash. Overall the signals do not conflict; they collectively indicate a low-urgency, locally-exploitable availability bug.

A malicious or compromised low-privilege application installed on a HarmonyOS 5.0.1 or 5.1.0 device issues crafted local requests to the office service, causing it to crash or become unresponsive and denying that functionality to the user. Because exploitation is local and requires existing low privileges with no user interaction, the realistic actor is an already-installed rogue app rather than a remote attacker. No public exploit code has been identified at time of analysis.