What is the CVSS score of CVE-2026-25781?

CVE-2026-25781 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of OpenHarmony are affected by CVE-2026-25781?

OpenHarmony v6.0 and earlier devices are vulnerable to a local memory corruption flaw (CVE-2026-25781, CVSS 8.4) enabling attackers with low-privilege local access to corrupt device memory and cause…

How to fix or mitigate CVE-2026-25781?

Within 24 hours: Inventory all OpenHarmony v6.0 and earlier deployments and flag those supporting critical operations. Within 7 days: Implement local access controls restricting low-privileged user capabilities and enable alerting for memory-related failures. Within 30 days: Establish patch monitoring through OpenHarmony security channels and evaluate upgrade or network isolation strategies for critical devices.

OpenHarmony CVE-2026-25781

EUVD-2026-30832 HIGH

Out-of-bounds Write (CWE-787)

2026-05-19 OpenHarmony

GHSA-7f33-7337-2rhg

Memory Corruption Buffer Overflow Openharmony

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:46 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.

AnalysisAI

Out-of-bounds write in OpenHarmony v6.0 and earlier enables a local low-privileged attacker to corrupt memory and trigger an unrecoverable denial-of-service condition on affected devices. The flaw was disclosed by the OpenHarmony project itself, and no public exploit identified at time of analysis. Although CVSS scores it 8.4 (High) due to scope change and high confidentiality/integrity impact, the vector indicates local-only access with low privileges already required.

Technical ContextAI

OpenHarmony is the open-source distributed operating system led by the OpenAtom Foundation, used in IoT, smart-home, automotive, and embedded devices across the Huawei HarmonyOS ecosystem. The root cause is CWE-787 (Out-of-bounds Write), a class of memory-corruption bug where code writes data past the bounds of an allocated buffer; the project's own tags also identify it as a buffer overflow and memory-corruption issue. CPE coverage (cpe:2.3:a:openharmony:openharmony:*) is wildcard across versions, with the advisory scoping impact to v6.0 and prior. Scope:Changed in the CVSS vector indicates the corrupted component can affect resources beyond its own security boundary, which on OpenHarmony typically maps to crossing a process or capability boundary inside the microkernel/multi-kernel architecture.

RemediationAI

No exact fixed version was supplied in the input data, so treat patch status as: patch available per vendor advisory - consult the OpenHarmony security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md for the specific commit or release tag and upgrade to the first OpenHarmony build that incorporates the fix. As compensating controls until the patch is rolled out, restrict which local user accounts and pre-installed applications hold the privilege level required to reach the vulnerable code path (PR:L), tighten SELinux/permission policy on the affected component, disable or sandbox third-party apps that do not need to run on the device, and for IoT/embedded deployments avoid shipping shared-user or developer-mode builds to production - the trade-off is reduced flexibility for on-device tooling and side-loaded apps.