Huawei HarmonyOS CVE-2025-58295

Exploitation requires local access to a device running HarmonyOS 5.0.1 or 5.1.0 together with pre-existing low-level privileges (PR:L) - for example, an already-installed or malicious application able to reach the affected development framework module. No user interaction is required (UI:N). Exploitation is fundamentally limited to a denial-of-service outcome: the CVSS vector reports no confidentiality or integrity impact (C:N/I:N) and only availability impact (A:H), so the worst realistic result is a crash or service unavailability, not code execution or data theft. The exact vulnerable interface within the 'development framework module' is not detailed in the available Huawei bulletin.

This is a low-to-moderate priority issue despite a 'Medium' CVSS of 5.5. All signals point to limited real-world risk: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a locally-exploitable, availability-only flaw requiring the attacker to already possess low-level privileges on the device, with no confidentiality or integrity impact. The EPSS score of 0.09% (0th percentile) indicates a very low probability of exploitation in the wild, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or widespread exploitation. No SSVC decision data was provided in the input. The signals are mutually consistent rather than conflicting - a local, authenticated, DoS-only stack buffer overflow is a code-quality/robustness problem more than an urgent security emergency. The main caveat is that Huawei's advisory is a bulletin landing page rather than a per-CVE technical writeup, so the exact affected component ('development framework module') and attack preconditions are not fully detailed; verify specifics with the Huawei PSIRT bulletin.

A local attacker who already has low-privilege code execution on a HarmonyOS 5.0.1 or 5.1.0 device (e.g., via a malicious or compromised app) invokes the vulnerable development-framework component with crafted input that overflows a stack buffer (CWE-121), crashing the process or service and degrading device availability. No public proof-of-concept exploit has been identified, and the flaw yields only a denial-of-service outcome, not code execution or data disclosure.