What is the CVSS score of CVE-2026-33565?

CVE-2026-33565 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

OpenHarmony CVE-2026-33565

EUVD-2026-30833 LOW

Signal Handler Race Condition (CWE-364)

2026-05-19 OpenHarmony

GHSA-3hp3-3r3c-hw6c

Information Disclosure Openharmony

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:48 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

AnalysisAI

Signal handler race condition in OpenHarmony v6.0 and prior enables a local, low-privileged attacker to cause a denial-of-service condition. The vulnerability (CWE-364) produces only low availability impact per the CVSS vector, with no confidentiality or integrity loss confirmed. No public exploit code or CISA KEV listing exists at time of analysis, placing this in a low-urgency tier despite the low attack complexity.

Technical ContextAI

CWE-364 (Signal Handler Race Condition) describes a class of bugs where a program's signal handler is invoked asynchronously while the process is in a vulnerable state, creating a TOCTOU-style race that can corrupt state or exhaust resources. The affected product is OpenHarmony, Huawei's open-source distributed operating system, up to and including v6.0, as identified by CPE cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*. Notably, the CVE description omits the specific component or subsystem where the race condition resides - this is a significant gap in the disclosure. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) confirms exploitation is constrained to local access with low privileges, and impact is limited to partial availability disruption.

RemediationAI

Consult the OpenHarmony security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md to identify whether a patched release version has been issued - no exact fix version is confirmed from available input data, so 'Patch available per vendor advisory' is the most accurate characterization. If upgrading immediately is not feasible, restrict local shell or process execution access on affected OpenHarmony devices to trusted users only, as the attack requires PR:L (low-privilege local account); removing unnecessary local accounts reduces the attacker surface. Because the vulnerable component is unspecified, disabling a specific feature as a workaround cannot be recommended without further vendor guidance.