What is the CVSS score of CVE-2026-25110?

CVE-2026-25110 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

OpenHarmony CVE-2026-25110

EUVD-2026-30824 LOW

NULL Pointer Dereference (CWE-476)

2026-05-19 OpenHarmony

GHSA-5x4c-vwv3-ghp2

Null Pointer Dereference Denial Of Service Openharmony

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:46 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

AnalysisAI

NULL pointer dereference in OpenHarmony v6.0 and prior enables a local low-privileged attacker to crash the system or an affected process, causing a denial-of-service condition. The vulnerability is confined to local exploitation with no confidentiality or integrity impact, as reflected in the CVSS:3.1 score of 3.3 (Low). No public exploit code has been identified at time of analysis, and no active exploitation has been reported.

Technical ContextAI

The vulnerability is rooted in CWE-476 (NULL Pointer Dereference), a memory safety defect where code attempts to dereference a pointer that has not been assigned a valid memory address, resulting in a process fault or kernel panic depending on where the dereference occurs. OpenHarmony is an open-source distributed operating system maintained by the OpenAtom Foundation, primarily targeting IoT and embedded devices. The affected CPE string cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:* indicates all sub-versions of the OpenHarmony application platform through v6.0 are potentially affected. The specific subsystem or component within OpenHarmony where the null pointer dereference occurs is not identified in the available data, limiting precise root-cause scoping.

RemediationAI

Consult the OpenHarmony April 2026 security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-04.md for patched release information - no specific fixed version number was provided in the available intelligence data, so a vendor-confirmed patch version cannot be cited here. Organizations should monitor the OpenHarmony security channel for an updated release and apply it promptly. As a compensating control where patching is not immediately possible, restrict the ability of untrusted local applications to interact with the vulnerable component by enforcing strict application sandboxing and least-privilege process isolation available within the OpenHarmony permission model. Because the attack requires local low-privilege access, limiting which user accounts or application packages can run on the device reduces the exploitable surface. Note that sandboxing controls depend on the specific OpenHarmony deployment profile and may not be uniformly available across all device categories.