Huawei HarmonyOS CVE-2026-101174

Exploitation requires the attacker to be on an adjacent network to the target HarmonyOS device (AV:A - e.g., the same local/proximity network used by DSoftBus for device-to-device distributed communication), and to hold low-level privileges (PR:L); no user interaction is needed (UI:N). The DSoftBus (distributed soft bus) module must be reachable for the attack. Limiting factors: the adjacency requirement rules out direct remote Internet exploitation, and the privilege requirement means a fully anonymous attacker cannot trigger it. The precise configuration or feature state required is not described in the available sources. Impact is limited to availability; there is no confidentiality or integrity effect.

This is a moderate-severity availability issue (CVSS 5.7) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H shows the key constraints: AV:A limits the attacker to an adjacent network (same local/proximity network segment, consistent with DSoftBus being HarmonyOS's device-to-device distributed communication bus), and PR:L means some level of privilege is required rather than fully unauthenticated access. Impact is confined to availability (A:H) with no confidentiality or integrity impact, matching CWE-400 (uncontrolled resource consumption). The vuln.today decision label is 'this_month', which signals a scheduled-remediation priority, not act_now or emergency. No EPSS score, no CISA KEV listing, and no PoC reference are present in the supplied data, so there is no evidence of active exploitation or available exploit code. Net assessment: a real but bounded defect - the adjacency requirement and privilege requirement meaningfully reduce real-world exposure, and the absence of KEV/EPSS/PoC signals suggests this is not a widespread exploitation risk at this time. The description is extremely sparse, so the precise trigger cannot be confirmed from the available sources.

An attacker positioned on the same adjacent network as a HarmonyOS device, already holding low-level privileges, interacts with the DSoftBus distributed-communication module in a way that exhausts or exhausts resources, rendering the affected service or device unavailable. The exact trigger is not described in the available sources. No public exploit identified at time of analysis.