What is the CVSS score of CVE-2026-25781?

CVE-2026-25781 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25781?

Within 24 hours: Inventory all OpenHarmony v6.0 and earlier deployments and flag those supporting critical operations. Within 7 days: Implement local access controls restricting low-privileged user capabilities and enable alerting for memory-related failures. Within 30 days: Establish patch monitoring through OpenHarmony security channels and evaluate upgrade or network isolation strategies for critical devices.

OpenHarmony CVE-2026-25781

EUVD-2026-30832 HIGH

Out-of-bounds Write (CWE-787)

2026-05-19 OpenHarmony

GHSA-7f33-7337-2rhg

Buffer Overflow Memory Corruption Openharmony

8.4

CVSS 3.1 · Vendor: OpenHarmony

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain low-privileged local foothold on device
Delivery

Identify vulnerable OpenHarmony IPC or syscall
Exploit

Send crafted oversized input
Execution

Trigger out-of-bounds write
Persist

Corrupt cross-boundary component memory
Impact

Cause unrecoverable denial of service

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Attacker must already have local code-execution on an OpenHarmony v6.0-or-earlier device with at least low-privilege credentials (PR:L) - typically an installed application or an authenticated local user account - and must be able to reach the vulnerable component that performs the out-of-bounds write. No user interaction is required (UI:N) and complexity is low (AC:L). Exploitation is limited by: the need for prior local access (no remote/network reachability), the requirement of a non-zero privilege level, and applicability only to OpenHarmony 6.0 and prior - devices on patched builds or non-OpenHarmony-derived OSes are out of scope.
Impact	The 8.4 CVSS rating is driven primarily by Scope:Changed combined with high confidentiality and integrity impact, not by ease of reach: the vector is AV:L/AC:L/PR:L/UI:N, meaning an attacker already needs local access with at least low-level credentials on the device. There is a notable conflict in the data - the description explicitly states an unrecoverable DoS, yet the CVSS vector lists A:N (no availability impact); this inconsistency should be verified against the OpenHarmony advisory before treating either claim as authoritative. No EPSS score, no KEV listing, and no public exploit identified at time of analysis, so realistic risk is bounded by the need for a foothold on the device; for embedded/IoT deployments where local access often implies physical or supply-chain compromise, the practical threat is moderate rather than urgent. Treat this as a meaningful priority for fleets exposing local execution to untrusted apps or shared users, and lower priority for sealed single-tenant devices.
Exploit ScenarioDerived	A malicious application installed on an OpenHarmony device, or a logged-in low-privileged local user, invokes the vulnerable interface with crafted input that overflows a buffer; the resulting out-of-bounds write corrupts memory in a component running with broader scope, crashing it in a state the system cannot recover from without a reboot or re-flash. No public exploit identified at time of analysis, but the AC:L/PR:L profile means weaponization is straightforward once the vulnerable syscall or IPC endpoint is identified.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 19, 2026

Out-of-bounds write in OpenHarmony v6.0 and earlier enables a local low-privileged attacker to corrupt memory and trigger an unrecoverable denial-of-service condition on affected devices. The flaw was disclosed by the OpenHarmony project itself, and no public exploit identified at time of analysis. Although CVSS scores it 8.4 (High) due to scope change and high confidentiality/integrity impact, the vector indicates local-only access with low privileges already required.

RemediationAI

No exact fixed version was supplied in the input data, so treat patch status as: patch available per vendor advisory - consult the OpenHarmony security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md for the specific commit or release tag and upgrade to the first OpenHarmony build that incorporates the fix. As compensating controls until the patch is rolled out, restrict which local user accounts and pre-installed applications hold the privilege level required to reach the vulnerable code path (PR:L), tighten SELinux/permission policy on the affected component, disable or sandbox third-party apps that do not need to run on the device, and for IoT/embedded deployments avoid shipping shared-user or developer-mode builds to production - the trade-off is reduced flexibility for on-device tooling and side-loaded apps.

Affected VersionsENISA

OpenHarmony v5.0.3 ≤v6.0

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenHarmony is the open-source distributed operating system led by the OpenAtom Foundation, used in IoT, smart-home, automotive, and embedded devices across the Huawei HarmonyOS ecosystem. The root cause is CWE-787 (Out-of-bounds Write), a class of memory-corruption bug where code writes data past the bounds of an allocated buffer; the project's own tags also identify it as a buffer overflow and memory-corruption issue. CPE coverage (cpe:2.3:a:openharmony:openharmony:*) is wildcard across versions, with the advisory scoping impact to v6.0 and prior. Scope:Changed in the CVSS vector indicates the corrupted component can affect resources beyond its own security boundary, which on OpenHarmony typically maps to crossing a process or capability boundary inside the microkernel/multi-kernel architecture.

Know when Openharmony gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OpenHarmony) PRIMARY 8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (OpenHarmony) · only source for this CVE.

CVSS VectorVendor: OpenHarmony

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.

Executive ViewAI

Why It Matters

OpenHarmony v6.0 and earlier devices are vulnerable to a local memory corruption flaw (CVE-2026-25781, CVSS 8.4) enabling attackers with low-privilege local access to corrupt device memory and cause unrecoverable denial-of-service. Organizations deploying OpenHarmony face operational risk through potential device unavailability with no vendor patch currently available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Restrict local user access via role-based access control and disable unnecessary local user accounts. Implement network segmentation to isolate affected devices from untrusted networks. Enable system-level memory fault detection and alerting. Monitor OpenHarmony security advisories daily for patch release announcements.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.