Huawei HarmonyOS CVE-2025-64315

Exploitation requires the attacker to already possess local, low-privileged access on the device (AV:L, PR:L) - for example, a malicious or compromised third-party app running under HarmonyOS 5.1.0. The specific trigger is a configuration defect within the file management module; the sparse vendor description does not name the exact setting or feature, so the precise misconfiguration cannot be enumerated from available data. Limiting factors: no remote network vector (not internet-exploitable), attacker must hold existing on-device privileges, and impact is confined to app data confidentiality and integrity (no availability/denial-of-service and no stated cross-system scope change, S:U). No user interaction is required once local access is held.

This is a moderate-severity, low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 7.1 High) describes a locally-exploitable flaw requiring low privileges, with high confidentiality and integrity impact but no availability impact - consistent with an on-device application (not a remote network) threat. All exploitation signals point AWAY from active, widespread risk: EPSS is 0.01% (1st percentile), there is no CISA KEV listing, and no public exploit code was identified. No SSVC decision data was provided in the input. The signals are internally consistent rather than conflicting: a local-only vector plus negligible EPSS plus no KEV means this is a real but low-priority defect best handled through routine patch cadence, not emergency response. The 'Privilege Escalation' tag aligns with CWE-264 (permissions/privileges/access control) and the local, low-privilege-to-high-impact profile. Note the description is extremely sparse ('Configuration defect vulnerability in the file management module'), so the precise mechanism cannot be independently verified beyond vendor-supplied CVSS metrics - verify specifics against the Huawei bulletin.

A malicious or low-privileged application already installed on a HarmonyOS 5.1.0 device abuses a misconfiguration in the file management module to read or alter data belonging to other apps that should be isolated from it. No remote access and no user interaction are required, but the attacker must already have local low-privileged code execution on the device. No public exploit code was identified at time of analysis.