Huawei EMUI/HarmonyOS CVE-2025-66329

Requires an attacker to already run code locally on the device as an app with low privileges (CVSS PR:L) - typically a malicious or compromised application installed on a Huawei EMUI (12.0.0-15.0.0) or HarmonyOS (2.0.0-4.3.1) handset - exploiting a permission-control defect in the window management module. No user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the attack is strictly local (AV:L), so no remote/network exploitation is possible; it requires prior app-level foothold rather than default/unauthenticated access; and impact is confined to availability (C:N/I:N) - an attacker can degrade or deny the window management service but cannot read data or execute privileged code via this flaw alone.

This is a moderate-severity, low-priority issue despite affecting a very widely deployed mobile OS. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5 MEDIUM) describes a LOCAL attack requiring already-granted low privileges (PR:L, i.e. an installed/authenticated app context) with impact limited strictly to availability (A:H), no confidentiality or integrity loss. All exploitation-probability signals point the same direction and are internally consistent: EPSS is 0.01% (1st percentile - essentially negligible predicted exploitation), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced. There is therefore no public exploit identified at time of analysis and no evidence of active exploitation. Note a minor internal tension worth verifying: the Tags include 'Privilege Escalation' and the CWE is CWE-264 (permissions/privileges/access control), yet the CVSS impact is availability-only (C:N/I:N) - this reads as a permission-control defect whose realized consequence is denial of service (e.g. crashing/hanging the window management service), not a true privilege gain; treat the 'Privilege Escalation' label with caution. No SSVC decision data was supplied in the input. Net: a locally-exploitable, authenticated DoS on consumer devices - real but low urgency, best handled through routine monthly patching rather than emergency response.

A malicious or compromised application already installed on a Huawei EMUI/HarmonyOS device (running with low, non-privileged app permissions and no user interaction) abuses a permission-control weakness in the window management module to crash or hang it, degrading device availability. Because the CVSS vector is AV:L/PR:L, the attacker must already have local code execution in an app context; it cannot be triggered remotely. No public exploit code is identified at time of analysis.