HarmonyOS DSoftBus CVE-2026-101173

Exploitation requires the attacker to be on the same adjacent network as the target (AV:A) - e.g. the same Wi-Fi/LAN segment or within the HarmonyOS distributed-device (DSoftBus) mesh - and to be able to reach the DSoftBus distributed soft bus service; this network-adjacency requirement is the primary limiting factor and precludes direct internet-scale exploitation. Within that reach, no authentication (PR:N), no user interaction (UI:N), and only low attack complexity (AC:L) are needed. The precise trigger (which DSoftBus message, protocol, or resource is exhausted) is not described in the available sources. Impact is confined to availability (C:N/I:N); there is no confidentiality or integrity effect.

This is a moderate-severity availability-only issue (CVSS 6.5) whose signals point to a bounded, non-emergency priority rather than a widespread crisis. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates an adjacent-network (not internet-wide) attack requiring no authentication and no user interaction, with impact limited to availability (C:N/I:N) - consistent with the CWE-400 uncontrolled-resource-consumption / DoS classification and the vendor's description. AV:A is the single most important limiter: the attacker must be on the same local/adjacent network (e.g. same Wi-Fi/LAN or Bluetooth-range distributed-device mesh) as the target, which sharply narrows remote mass exploitation. There is no CISA KEV listing, so this is not confirmed actively exploited; no EPSS score was provided in the input, so exploitation probability cannot be quantified here; and no public exploit or PoC reference is present, so the status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns with the signals - a real issue worth patching on a normal cycle, not an act_now/emergency. Net: a genuine but contained availability risk, not a high-CVSS-but-illusory issue, with its real-world risk governed chiefly by whether an attacker can reach the adjacent network segment.

An attacker who has gained a foothold on the same local network or distributed-device cluster as a HarmonyOS device sends crafted traffic to the DSoftBus (distributed soft bus) service, triggering uncontrolled resource consumption (CWE-400) that degrades or disrupts the device's availability. No credentials or user interaction are required (PR:N/UI:N) and complexity is low (AC:L), but reachability is limited to the adjacent network (AV:A). No public exploit code is identified at time of analysis.