Huawei HarmonyOS CVE-2025-66328

Exploitation requires local access to a HarmonyOS 5.0.1 device with at least low-level privileges (PR:L) - e.g., a malicious or compromised local app/process - not remote network reach. The attacker must repeatedly trigger concurrent operations in the network management module to hit a narrow, non-deterministic timing window, which is the source of the HIGH attack complexity (AC:H) and a significant practical limiter: success is probabilistic and may require many attempts. No user interaction is needed (UI:N). Impact is limited to availability (service crash/hang/DoS); no data is exposed or modified. The main limiting factors reducing real-world risk are the local-only vector, the privilege requirement, and the timing-dependent reliability of winning the race.

This is a low-priority issue despite being a locally-exploitable availability flaw. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7 Medium) is internally consistent with the description: a multi-thread race condition (CWE-362) in the HarmonyOS network management module that affects only availability (C:N/I:N). Every signal points away from urgency: the attack vector is LOCAL (AV:L), not network, so an attacker must already have code execution or low-privilege access (PR:L) on the device; the attack complexity is HIGH (AC:H), consistent with the non-deterministic timing window inherent to race conditions; and the impact is confined to availability with no confidentiality or integrity loss and no scope change (S:U). The EPSS score of 0.01% (1st percentile) corroborates negligible real-world exploitation likelihood. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. One data inconsistency worth noting: the input Tags include 'Information Disclosure,' which directly contradicts the CVSS vector (C:N) and the vendor description (availability-only impact) - this tag appears mislabeled and should not drive risk decisions.

A low-privileged local process or malicious app already running on a HarmonyOS 5.0.1 device repeatedly triggers concurrent operations in the network management module, trying to win a narrow timing window in which two threads access shared state unsafely. Hitting that race corrupts module state and causes a crash or hang, degrading or disabling network functionality (denial of service) until the service or device is restarted. No public exploit code has been identified, and the HIGH attack complexity means success is probabilistic rather than reliable.