Huawei HarmonyOS CVE-2025-58299
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local access on device
-
ExploitTrigger use-after-free in storage management module
-
ImpactCrash subsystem causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the device (AV:L) with existing low-level privileges (PR:L) - an attacker must already run code or hold an account on the HarmonyOS device to reach the storage management module; it is not remotely or network-triggerable and needs no user interaction (UI:N). Exploitation is limited to HarmonyOS versions 5.0.1 and 5.1.0, and the realized impact is confined to availability (service/device crash), with no confidentiality or integrity effect per the vendor vector. The specific storage-module interface or API that frees and reuses the object is not detailed in the available description. |
| Impact | This is a moderate-severity, availability-only issue that does not rise to urgent-priority status. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a local attacker who already holds low privileges and can trigger a use-after-free in the storage management module to crash or degrade the service - confidentiality and integrity are explicitly unaffected (C:N/I:N). All risk signals point the same direction and are consistent with one another: EPSS is very low at 0.10% (1st percentile), the CVE is NOT on CISA KEV, and there is no public exploit. There is no SSVC decision data in the input. The one point to verify is the gap between the generic 'use after free' CWE-416 (a class often leveraged for code execution) and the vendor's CVSS, which scopes impact strictly to availability - the vector's C:N/I:N should be confirmed against the Huawei bulletin, since UAF primitives can sometimes be escalated beyond denial of service. On balance this is a real but low-priority local DoS, not a high-real-risk flaw. |
| Exploit ScenarioDerived | A local application or user with low-level privileges on a HarmonyOS 5.0.1 or 5.1.0 device makes crafted calls into the storage management module that cause a freed object to be reused, corrupting memory and crashing the subsystem or the device. No public exploit code has been identified, and exploitation yields denial of service rather than data theft or code execution per the vendor's scoring. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A use-after-free vulnerability in the storage management module of Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low privileges to cause a denial of service by crashing the affected service. Exploitation requires local access and existing low-level privileges, and no user interaction is needed. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.10% (percentile 1%), indicating a moderate-severity, availability-only issue that does not rise to urgent-priority status.
RemediationAI
Huawei has released a security bulletin addressing this vulnerability; apply the latest HarmonyOS updates as provided by the vendor. The advisory at https://consumer.huawei.com/en/support/bulletin/2025/10/ likely contains specific patch information. As no exact fix version is provided in the input data, refer to the advisory for the patched version. As a workaround, limiting local access to trusted users and restricting the installation of untrusted applications can reduce the attack surface, but these measures may not fully prevent exploitation by a determined local attacker with existing low privileges. No specific feature to disable is identified in the available information.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in HarmonyOS's storage management module, which handles file system or storage operations. It occurs when the module frees a memory object but continues to use it, leading to memory corruption and potential crashes. Affected versions are HarmonyOS 5.0.1 and 5.1.0 as indicated by CPE entries. The CVSS vector (AV:L/PR:L) indicates the attacker must have local access and low privileges, such as a malicious app or a user with restricted shell access, to trigger the flaw. The specific interface or API that frees and reuses the object is not detailed in the available description.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Storage-module UAF reachable only by a local low-privileged process (AV:L/PR:L), no user interaction, with impact limited to availability (A:H) and no confidentiality/integrity effect.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
GitHub PoC
Exploit-DB