Huawei HarmonyOS CVE-2025-58293

Requires local access on a HarmonyOS 5.0.1 or 5.1.0 device with at least low-level privileges (PR:L) - i.e., an attacker-controlled or compromised application already running on the device that can invoke the print module. There is no network vector and no user interaction required (UI:N), but exploitation is strictly limited to code already executing locally; it cannot be triggered remotely or by an unauthenticated external attacker. Impact is confined to availability (crash/denial of the print functionality) with no data disclosure or modification.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 score of 5.5 (MEDIUM) is driven entirely by the availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N), and the attack vector is local (AV:L) requiring existing low-level privileges (PR:L) - meaning an attacker must already have code execution or app-level access on the HarmonyOS device to trigger it. The EPSS score is extremely low (0.09%, 0th percentile), there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals align toward low real-world urgency: no public exploit identified at time of analysis. CONFLICT TO NOTE: the input Tags label this 'Privilege Escalation', but the CVSS vector shows only availability impact (C:N/I:N/A:H) and CWE-264, consistent with a local denial-of-service/crash via improper exception handling, not a privilege gain - treat the privilege-escalation characterization as unverified. Overall this is a genuine but low-risk, locally-scoped availability bug rather than a widespread exploitation threat.

A malicious or compromised low-privilege application already installed on a HarmonyOS device invokes the print module with malformed input that is not properly handled by the exception logic, causing the service or process to crash. No public proof-of-concept exists, and because the attack vector is local with low complexity, exploitation is feasible only for code already running on the device, limiting impact to a denial of print/service availability.