Huawei HarmonyOS CVE-2025-64312

The vulnerability resides in the HarmonyOS file management module's permission-control logic; exploitation requires reaching that module to bypass access checks and read files the caller is not authorized to access. The description provides no explicit configuration prerequisite, but the nature of a file-management permission bypass on a mobile OS strongly implies a locally present (e.g., installed malicious or compromised) application as the actor, which LIMITS exploitation to attackers who already have code running on the device - contradicting the vendor's AV:N scoring. Impact is confined to confidentiality (information disclosure); integrity and availability are unaffected. Affected versions are HarmonyOS 5.0.1, 5.1.0, and 6.0.0.

Signals point consistently toward a LOW real-world priority despite the 7.5 'High' base score. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, unauthenticated, low-complexity confidentiality breach, which on its face looks serious; however, the EPSS score is 0.02% (5th percentile), there is no CISA KEV listing, no public POC, and the exploitation status is 'no public exploit identified at time of analysis.' There is also an apparent CONFLICT between the metadata and the technical reality: the flaw is described as a 'permission control vulnerability in the file management module' of a mobile OS (HarmonyOS), which typically implies a local malicious app bypassing file-access permissions rather than a remote network attack - yet Huawei scored it AV:N/PR:N. This should be verified with Huawei's bulletin, as a local/low-privilege vector (AV:L or PR:L) would meaningfully lower the real risk. Net: treat as routine patch-cycle priority, not an emergency, pending clarification of the attack vector. No signal indicates active or widespread exploitation.

A malicious or over-privileged application installed on a HarmonyOS device abuses a permission-control weakness in the file management module to read files belonging to other apps or the system that it should not be able to access, disclosing sensitive data. No public exploit code is known, and the realistic trigger likely requires local app presence despite the vendor's network-vector scoring.