Huawei HarmonyOS CVE-2026-101184

Requires local access to a Huawei HarmonyOS or EMUI device (AV:L) - consistent with a malicious or compromised local application abusing the Bluetooth module's permission control - plus user interaction (UI:R) to trigger the flaw; the precise feature, configuration, or action that triggers it is not described in the available sources. Exploitation is bounded to Huawei HarmonyOS and EMUI platforms and yields only an availability impact (C:N/I:N/A:H), so there is no data disclosure or integrity compromise path. Limiting factors: no remote/network vector, mandatory user interaction, and device must run an affected Huawei OS build.

This is a medium-severity (CVSS 5.5) local availability issue, not an urgent remote threat. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is internally consistent and self-limiting: exploitation requires local access (AV:L) plus user interaction (UI:R), and the only consequence is an availability loss (A:H) with no confidentiality or integrity impact (C:N/I:N). The vuln.today decision label is 'this_month', indicating a prioritize-but-not-emergency posture rather than act_now/emergency. There is no CISA KEV listing and no EPSS score supplied in the input, and no PoC or exploit reference is present - only Huawei vendor bulletins - so there is no evidence of active or imminent exploitation. One signal conflicts with the impact data: the input Tags include 'Privilege Escalation' and the CWE is CWE-264 (permissions/privileges/access control), yet the CVSS impact is availability-only with C:N/I:N - verify with Huawei whether any privilege or data impact exists beyond the stated denial-of-service, as the tag and the scored impact disagree. On balance this reads as a genuine but low-urgency local DoS/permission-control defect rather than a high-priority remotely weaponizable flaw.

A malicious or compromised application installed on a Huawei HarmonyOS or EMUI device abuses a permission-control weakness in the Bluetooth module, and after the user performs some interaction the flaw is triggered to degrade or crash Bluetooth functionality, causing a denial of service. Exploitation is local (AV:L) and low-complexity (AC:L) but requires user interaction (UI:R) and yields only availability impact. No public exploit code or PoC reference is identified in the available sources.