Huawei HarmonyOS
CVE-2025-58297
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv local code execution on device
-
ExploitCraft oversized input to sensor service
-
ExecutionTrigger stack buffer overflow (CWE-121)
-
ImpactCrash sensor service (availability loss)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a Huawei HarmonyOS 5.1.0 device with at least low-level privileges (e.g. a locally installed/running app or shell), per AV:L/PR:L. The attacker must be able to reach and supply crafted input to the sensor service to overflow its stack buffer. Limiting factors: there is no remote vector (local only), authentication/low privilege is required, no user interaction of a victim is needed (UI:N), and impact is bounded to availability (service crash/DoS) with no confidentiality or integrity effect. Exploitation is further constrained to the specific HarmonyOS 5.1.0 release named in the CPE. |
| Impact | This is a moderate-severity, low-real-risk local availability bug. The Huawei-provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 MEDIUM) describes a stack buffer overflow (CWE-121) in the sensor service that is reachable only by a local actor already holding low privileges on the device, and whose impact is confined to availability (C:N/I:N) - consistent with Huawei's own statement that exploitation 'may affect availability,' i.e. a crash/DoS of the sensor service rather than code execution. EPSS is 0.09% (0th percentile), indicating essentially no predicted exploitation activity. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation. No SSVC decision data was supplied. Signals are consistent rather than conflicting: a local-only, authentication-gated, availability-only flaw with negligible exploitation probability is a routine patch-cycle item, not an emergency. One caveat: although the CWE (stack buffer overflow) is a classic memory-corruption primitive that can sometimes be escalated beyond DoS, the vendor explicitly caps impact at availability and no confidentiality/integrity impact is claimed - treat any code-execution speculation as unverified. |
| Exploit ScenarioDerived | A locally-installed malicious or compromised app running with low privileges on a HarmonyOS 5.1.0 device sends malformed input to the sensor service, overflowing a stack buffer and crashing the service. The result is a denial of service affecting sensor-dependent functionality; no remote vector and no data exposure are involved. No public proof-of-concept exists at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
A stack-based buffer overflow in the sensor service shipped with Huawei HarmonyOS 5.1.0 lets a local attacker who already holds low-level privileges on the device crash or destabilize the service, degrading availability. Exploitation requires local access to the device and the ability to feed crafted input to the sensor service (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is confined to the specific 5.1.0 release named in the CPE and carries no confidentiality or integrity impact. There is no evidence of active exploitation (not in CISA KEV), no public exploit code has been identified, and EPSS is negligible at roughly 0.09%, making this a moderate-severity, low-real-risk local availability bug.
RemediationAI
No vendor-released patch version is identified in the available data; the primary action is to apply the HarmonyOS security update referenced in Huawei's October 2025 consumer bulletin (https://consumer.huawei.com/en/support/bulletin/2025/10/) and confirm the installed build no longer corresponds to the affected 5.1.0 CPE. Until that update is applied, compensate by treating the sensor service as a local attack surface: restrict installation of untrusted or sideloaded applications and tighten app-permission/device-management policy so that low-privileged local code has fewer opportunities to reach the service, accepting the trade-off of reduced flexibility for end users and developers. Where enterprise policy allows, monitor or gate access to sensor APIs for non-system apps, understanding that some fitness, AR and accessibility applications may lose functionality. Reboot or watchdog-restart the sensor-related processes on repeated failure as an interim availability control, recognizing this only recovers the service rather than fixing the underlying memory-safety defect. Note that Huawei device patch availability and rollout timing are governed by the bulletin and carrier/OEM channels, so verify the exact fixed build against the advisory rather than assuming a specific version number.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow (tagged as both buffer overflow and stack overflow) inside the HarmonyOS sensor service, the component that brokers sensor data such as accelerometer, gyroscope and proximity readings to applications. Because the vulnerable code runs as a privileged system service but is reachable from a low-privileged local context, the CVSS vector places it at AV:L/PR:L, meaning an attacker must already be running code or a shell on the device (for example a locally installed app) and then supply malformed input to the sensor service's parsing path. The overflow corrupts stack memory, and per the assessed vector the only demonstrable consequence is a crash or denial of service of the service (A:H) with no measured effect on confidentiality (C:N) or integrity (I:N); scope is unchanged and no victim user interaction (UI:N) is needed. The authoritative assessment confirms a local-only attack surface and a specific affected release.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local sensor-service bug reachable by a low-privileged on-device actor (AV:L/PR:L), straightforward trigger (AC:L), vendor caps impact at availability only (C:N/I:N/A:H).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)NVD
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB