What is the CVSS score of CVE-2026-28751?

CVE-2026-28751 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

OpenHarmony CVE-2026-28751

EUVD-2026-30827 LOW

Improper Input Validation (CWE-20)

2026-05-19 OpenHarmony

GHSA-7gq8-55gr-wpmv

Information Disclosure Openharmony

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:47 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

AnalysisAI

Local denial-of-service in OpenHarmony v6.0 and prior versions exploits an improper input validation flaw (CWE-20), allowing a low-privileged local attacker to partially disrupt availability without requiring user interaction. The CVSS score of 3.3 (Low) reflects constrained impact: availability impact is rated Low (A:L), with no confidentiality or integrity loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the lower tier of operational urgency.

Technical ContextAI

OpenHarmony is the open-source distributed operating system developed under the OpenAtom Foundation (originally Huawei-backed), targeting IoT, embedded, and mobile device deployments. The affected CPE (cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*) covers all versions up to and including v6.0 without version-specific bounding on the lower end. CWE-20 (Improper Input Validation) indicates the root cause is failure to adequately check, sanitize, or constrain attacker-supplied input before it is processed - a class of flaw that, when triggered locally, can cause abnormal termination or resource exhaustion in affected components. The exact internal component or subsystem containing the vulnerable input path is not identified in the available data, as the CVE description is structurally incomplete (missing the subject/component noun).

RemediationAI

Consult the OpenHarmony April 2026 security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-04.md for the vendor-confirmed patched release version - an exact fix version is not independently confirmed from the data provided and should not be inferred. Apply the vendor-released patch once identified and tested for your deployment target. As a compensating control pending patching, restrict local shell or application-layer access on OpenHarmony devices to only trusted, necessary accounts, reducing the pool of principals capable of triggering the flaw. Given the local-only attack vector, network-level mitigations provide no protective value here. The low severity and lack of active exploitation make emergency patching unnecessary for most deployments, but standard patch cycles should include this fix.