Huawei HarmonyOS CVE-2025-66327

Exploitation requires the attacker to already have local, low-privilege code execution on the HarmonyOS device (PR:L, AV:L) - for example, a malicious or compromised installed application - and the ability to repeatedly trigger operations in the network module to win a race-condition timing window. The limiting factors are significant: the attack is local-only (no remote/network reach), demands pre-existing authenticated access on the device, and carries high attack complexity (AC:H) because the attacker must reliably exploit a non-deterministic concurrency timing window, which typically requires many attempts and offers no guarantee of success. No user interaction is required (UI:N). Impact is limited to confidentiality disclosure; the flaw cannot alter data or disrupt availability.

This is a genuinely low-priority vulnerability despite its CRITICAL-sounding CWE class (race condition / information disclosure). All signals align toward low real-world urgency rather than conflicting. The CVSS 3.1 base score is 4.7 (Medium), and the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N justifies this: exploitation requires local access (AV:L), already-held low privileges on the device (PR:L), and the high attack complexity (AC:H) inherent to winning a race-condition timing window. EPSS is 0.01% (0th percentile), the lowest practical band, indicating essentially no observed or predicted exploitation activity. The CVE is NOT in CISA KEV, and no public exploit code was identified in the provided intelligence - so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The only impact is confidentiality (C:H, I:N, A:N), meaning this can leak sensitive data from the network module but cannot modify data or crash the service. The signals are mutually consistent (low EPSS, no KEV, no POC, local vector, high complexity), so confidence that this is a low-real-risk issue is high. It warrants routine patching via Huawei's December 2025 security update rather than emergency response.

A malicious or compromised low-privilege application already installed on a HarmonyOS device repeatedly triggers an operation in the network module while racing a concurrent operation, aiming to hit the narrow timing window where shared state is inconsistent. If the race is won, the attacker's app reads sensitive network-related data it should not have access to, breaching service confidentiality. No public proof-of-concept exists, and the high attack complexity means success is probabilistic and may require many attempts.