What is the CVSS score of CVE-2026-25850?

CVE-2026-25850 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

OpenHarmony CVE-2026-25850

EUVD-2026-30831 MEDIUM

Improper Preservation of Permissions (CWE-281)

2026-05-19 OpenHarmony

GHSA-vg48-6574-px53

Information Disclosure Openharmony

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:47 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak

AnalysisAI

OpenHarmony v6.0 and prior versions expose sensitive information to local low-privileged attackers due to improper preservation of permissions (CWE-281). A locally authenticated attacker with standard user privileges can exploit this flaw to leak confidential data - achieving high confidentiality impact - without requiring elevated rights or user interaction. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and no-interaction-required nature of the attack make it straightforward to exploit once access is obtained.

Technical ContextAI

OpenHarmony is Huawei's open-source distributed operating system targeting IoT, embedded, and mobile device categories, tracked under CPE cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*. The root cause is CWE-281 (Improper Preservation of Permissions), which occurs when a software resource - such as a file, IPC handle, shared memory segment, or inter-process communication object - is transferred, copied, or re-created without correctly carrying forward access control metadata. In the OpenHarmony context this likely manifests in the system's microkernel or distributed data management layer, where sensitive resources may be accessible to processes that should not hold read permissions. The CVSS vector (AV:L/AC:L/PR:L) confirms the flaw is reachable from a local process running with standard (non-root) privileges, and the high confidentiality impact (C:H) indicates that meaningful sensitive data - potentially credentials, tokens, or protected system state - is accessible.

RemediationAI

The primary remediation is to apply the patch referenced in the OpenHarmony May 2026 security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md. An exact fixed version number was not independently confirmed from the available intelligence - the patch availability is confirmed per vendor advisory, but consumers should verify the specific patched release tag from the OpenHarmony security repository before deploying. As a compensating control on devices where patching is not immediately possible, administrators should restrict the installation and execution of untrusted third-party applications, as exploitation requires a locally running process with at least low-privilege credentials. Enforcing strict application sandboxing and reviewing inter-process communication permissions for sensitive system services can reduce the exposure surface. Note that these mitigations do not eliminate the vulnerability and should be treated as temporary measures pending patch deployment.