Huawei EMUI/HarmonyOS CVE-2025-66325

Exploitation requires local code execution on the affected Huawei device with low privileges already granted (CVSS AV:L/PR:L) - in practice, an attacker-controlled or compromised application installed on an EMUI 12.0.0-15.0.0 or HarmonyOS 2.0.0-4.3.1 device that then abuses the package management module's permission control to access data beyond its authorization. No user interaction is required (UI:N), but the dependency on prior local app presence and some existing privilege level, combined with confidentiality-only impact (no integrity or availability effect), substantially limits real-world risk; there is no remote or network-based path.

This is a genuinely low-priority issue despite the MEDIUM 5.5 CVSS rating, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local, low-privilege flaw with no integrity or availability impact - exploitation requires code already executing on the device (e.g., a malicious or compromised app with some privileges), not a remote network path. The EPSS score of 0.01% (1st percentile) is extremely low and aligns with the local attack vector and the absence of any exploit tooling. This CVE is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or weaponization. The only elevated metric is confidentiality (C:H), meaning a successful exploit discloses protected data but cannot modify it or disrupt service. Net assessment: a defense-in-depth mobile OS permission-control weakness worth patching in routine cycles, not an emergency. No key signals conflict; the main limitation is the sparse vendor description, which does not name the specific data exposed.

A malicious application installed on a Huawei EMUI or HarmonyOS device abuses a permission-control weakness in the package management module to read data it should not be able to access, breaching the confidentiality of another app or service. Because the CVSS vector is local with low privileges required (AV:L/PR:L), the attacker must already have an app running on the device rather than attacking it remotely. No public exploit code is identified at time of analysis.