Openharmony CVE-2026-0639

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates low real-world severity: the attack requires local access and low privileges, making it a post-compromise or insider threat rather than a remote exploit vector. The attack complexity is low (no special conditions needed) and requires no user interaction, which increases operational risk for multi-user systems or shared devices. However, the impact is strictly availability-focused (denial of service only)—no data confidentiality or integrity is compromised. No EPSS score or KEV (Known Exploited Vulnerability) status was provided in the intelligence data, suggesting this vulnerability may not yet be actively exploited in the wild or may have low public visibility. The combination of local-only access requirement and low impact places this in a medium-priority category for patching, especially for embedded IoT deployments where memory is constrained; however, it does not warrant emergency response. Risk is elevated in scenarios where the system hosts untrusted local users or processes.

An authenticated local user on a multi-user OpenHarmony system (such as a shared IoT gateway or industrial device) repeatedly executes a lightweight local operation or triggers a specific syscall that fails to release allocated memory. Over minutes to hours, repeated invocations cause kernel or application memory pools to become exhausted, leading to allocation failures for legitimate system processes, eventual system slowdown, service crashes, or unresponsiveness. Because the attack requires local access and low privileges, it is most practical in scenarios where an untrusted application, service, or user account has been granted local execution rights—either through a previous breach or by design in a multi-tenant embedded system.