Huawei HarmonyOS CVE-2025-58314

Exploitation requires local access to the device with the ability to run low-privileged code (PR:L) that interacts with the affected component driver module - typically a malicious, trojanized, or compromised application already installed on an EMUI 12.0.0-15.0.0 or HarmonyOS 2.0.0-4.2.0 device. No user interaction is needed once such code runs (UI:N), and no special configuration is called out. The decisive limiting factor is that there is no remote or network vector (AV:L): the attacker must first achieve on-device execution, so this cannot be exploited by a remote unauthenticated attacker against a default device out of the box.

Signals converge on a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 7.1 HIGH) describes a locally-exploitable out-of-bounds read (CWE-125) in a device driver module that already-present low-privileged code can trigger with no user interaction, yielding high confidentiality loss (memory disclosure) and high availability loss (driver/kernel crash). EPSS is 0.01% (1st percentile), extremely low, which is consistent with a local-only mobile driver bug that cannot be mass-scanned or remotely sprayed. There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The dominant limiting factor is the local attack vector: an attacker must already be executing code on the device (e.g., a malicious or compromised app), which sharply constrains real-world reach versus the raw 7.1 score. Net: a legitimate patch-worthy defense-in-depth issue for Huawei device fleets, but not a drop-everything emergency given local-only access and near-zero EPSS.

A malicious or compromised low-privileged application installed on a Huawei EMUI or HarmonyOS device issues crafted calls to the vulnerable component driver, triggering an out-of-bounds read. The attacker leaks sensitive adjacent memory contents (high confidentiality impact) and/or crashes the driver to cause denial of service. No public exploit code is identified at time of analysis, and the attack requires prior local code execution rather than remote access.