OpenHarmony CVE-2026-24792

Exploitation requires network reachability to an OpenHarmony device running version 6.0 or earlier and low-privilege authentication credentials (PR:L) on the target, with the vulnerable pre-installed app's service endpoint exposed and reachable to the attacker. The vulnerability is a CWE-364 signal handler race condition, so successful exploitation depends on winning a timing race during signal handling within the targeted pre-installed application's process - though the CVSS vector claims AC:L, race condition exploitation typically requires repeated attempts or specific timing conditions. No user interaction is required (UI:N), and the scope is unchanged (S:U), meaning the attacker gains code execution only within the privileges of the affected pre-installed app rather than escalating beyond it. Limiting factors include the authenticated access requirement and the need for the vulnerable pre-installed app to be present and reachable on the device.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H indicates network-reachable exploitation with low complexity by an authenticated attacker with low privileges, yielding high confidentiality and availability impact but notably no integrity impact - an unusual profile for an RCE claim that warrants scrutiny. EPSS and KEV data were not provided in the input, and no public exploit has been identified, so real-world exploitation pressure cannot be quantified from available signals. The combination of CWE-364 (race condition) with AC:L is somewhat contradictory, as race conditions typically exhibit timing-dependent reliability that would suggest AC:H - defenders should verify the attack complexity claim with the vendor. The 'remote attacker' wording in the description combined with AV:N suggests network-exposed pre-installed app services, but the specific service surface is not documented in the provided sources.

An attacker who has obtained low-privilege credentials on an OpenHarmony 6.0 device - for example through a compromised user account or a companion app token - sends crafted network requests to a vulnerable pre-installed application, triggering the signal handler race condition (CWE-364) during signal processing. By winning the race, the attacker hijacks execution flow within the pre-installed app's process context, gaining arbitrary code execution on the device. No public proof-of-concept has been identified at time of analysis.