What is the CVSS score of CVE-2026-27766?

CVE-2026-27766 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

OpenHarmony CVE-2026-27766

EUVD-2026-30830 MEDIUM

Signal Handler Race Condition (CWE-364)

2026-05-19 OpenHarmony

GHSA-382c-r87v-m473

Information Disclosure Openharmony

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:48 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.

AnalysisAI

Information disclosure in OpenHarmony v6.0 and earlier enables a low-privileged local attacker to leak high-sensitivity data from the system without any user interaction. The root cause is a signal handler race condition (CWE-364), where asynchronous signal delivery can expose protected memory contents while leaving system integrity and availability unaffected. No public exploit code has been identified at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability is rooted in CWE-364, a signal handler race condition. Signal handlers in POSIX-compliant operating systems are invoked asynchronously when a process receives a signal, interrupting normal execution at non-deterministic points. If a signal handler accesses shared state or memory regions that are also manipulated by the main execution context - without proper synchronization primitives - an attacker with the ability to send signals can exploit the timing window to cause unintended reads of sensitive memory. OpenHarmony is Huawei's open-source distributed OS targeting IoT, embedded, and mobile device categories. The CPE string cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:* confirms the vulnerability spans all tracked versions of the platform up to and including v6.0. The specific internal component or subsystem containing the vulnerable signal handler is not identified in the available description, as the text appears truncated.

RemediationAI

Consult the OpenHarmony May 2026 security advisory at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md to identify the specific patched release and apply the vendor-supplied update as the primary remediation. A patch is referenced by the vendor advisory; however, the exact fixed version number is not independently confirmed in the available intelligence - verify the minimum safe version directly from the advisory before upgrading. As compensating controls where immediate patching is not feasible: restrict the number of low-privilege local accounts or processes on affected devices, enforce strict process isolation to prevent unprivileged processes from sending signals to sensitive system processes (e.g., via seccomp or SELinux policy on compatible configurations), and audit which processes handle signals while accessing sensitive memory. Note that signal-filtering policies may affect legitimate inter-process communication and should be tested for operational impact before deployment.