What is the CVSS score of CVE-2026-28733?

CVE-2026-28733 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

OpenHarmony CVE-2026-28733

EUVD-2026-30834 MEDIUM

Use After Free (CWE-416)

2026-05-19 OpenHarmony

GHSA-g7x6-q2cp-cfqw

Memory Corruption Use After Free RCE Openharmony

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:48 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution.

AnalysisAI

Use-After-Free memory corruption in OpenHarmony v6.0 and prior enables a local attacker with low privileges to execute arbitrary code, achieving a changed scope with high availability impact. The vulnerability is rooted in CWE-416, where freed memory regions are accessed without proper lifecycle management, a class of flaw frequently exploitable for control-flow hijacking. No public exploit code or CISA KEV listing has been identified at time of analysis, though the OpenHarmony security team has published a formal disclosure.

Technical ContextAI

CWE-416 (Use After Free) describes a condition where a program continues to use a pointer after the underlying memory has been freed, allowing an attacker to manipulate heap state and redirect execution flow. In OpenHarmony (CPE: cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*), an IoT/mobile operating system developed under the OpenAtom Foundation, this class of flaw in a kernel or privileged subsystem component can bridge the boundary between user-space and a higher-privilege domain. The CVSS vector S:C (Changed Scope) corroborates this cross-boundary impact, suggesting the vulnerable component operates in a context that can affect resources outside its own trust boundary, consistent with a kernel driver or system service UAF.

RemediationAI

Upgrade OpenHarmony to a version beyond v6.0 as directed by the vendor's May 2026 security disclosure, available at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md. An exact patched release version is not independently confirmed from the available data - patch status is 'patch available per vendor advisory' and the precise fix version should be verified directly against the OpenHarmony release notes. As a compensating control where patching is not immediately feasible, restrict the attack surface by limiting untrusted local user access and preventing installation of unvetted third-party applications on affected devices; note this reduces but does not eliminate risk, as legitimate low-privilege users could still trigger the flaw. For IoT deployments, physical access controls and network isolation of devices reduce attacker reach to the local vector required.