Huawei HarmonyOS CVE-2025-58291

Requires local access to an affected device (AV:L) with low-level privileges already granted (PR:L), such as an installed app or authenticated local user, and no user interaction (UI:N). Exploitation is limited to Huawei HarmonyOS versions 5.0.1 and 5.1.0 and targets the 'office service' specifically; impact is confined to availability of that service (scope unchanged, S:U) with no confidentiality or integrity effect. The need for pre-existing local privileges is the primary limiting factor, preventing remote or unauthenticated abuse.

This is a moderate, locally-exploitable availability issue, not a widespread remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) confirms a local attack vector requiring low-level authenticated privileges with no user interaction, impacting availability only (A:H) with no confidentiality or integrity effect. All exploitation signals point low: EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and no public POC was identified. These signals are mutually consistent - a low-probability, low-priority issue rather than a high-CVSS-but-hidden-risk case. The main caveat is the thin vendor description ('Denial of service vulnerability in the office service'), which names neither the exact component behavior nor the trigger; CWE-29 (Path Traversal: '\..\filename' / leading backslash) is an unusual mapping for a pure DoS and should be verified against the Huawei bulletin. Overall: a legitimate patch-in-normal-cycle item on affected HarmonyOS devices, not an emergency.

A low-privileged local app or authenticated user on a HarmonyOS 5.0.1 or 5.1.0 device sends crafted input to the 'office' service, triggering a fault that makes the service unavailable. No public exploit code was identified, and exploitation requires existing local access rather than remote reach, limiting realistic impact to a local app crashing or hanging the targeted service.