EUVD-2026-21796
GHSA-7qf2-g97r-ch8v
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.
AnalysisAI
Stack overflow in HarmonyOS media platform allows authenticated local attackers to cause denial of service and potentially achieve limited information disclosure or integrity compromise through malicious user interaction. CVSS 6.1 reflects moderate severity with local attack vector, low complexity, and requirement for user interaction; EPSS and KEV status not provided. No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
The vulnerability exists in HarmonyOS media platform handling, specifically involving stack memory exhaustion (CWE-835: Infinite Loop) within media processing routines. The affected component processes user-supplied media data that triggers unbounded recursion or iteration, causing stack overflow. HarmonyOS spans multiple device classes (smartphones, wearables, laptops per referenced bulletins), all using the same underlying media stack. The local attack vector combined with user interaction requirement (UI:R in CVSS vector) indicates the attacker must either have local system access or trick a user into opening malicious media content. Authenticated privilege requirement (PR:L) further restricts exposure to users already logged into the system.
RemediationAI
Huawei has released patches for affected HarmonyOS versions distributed through separate security bulletins for each device class. Consumers should navigate to their device-specific bulletin (consumer.huawei.com support section for phones, wearables, or laptops) and apply the recommended security update. Update procedures vary by device type; follow the device-specific instructions provided in the bulletin. As an interim measure, avoid opening untrusted or suspicious media files from unknown sources, and restrict local system access to trusted users only. Patch availability per vendor advisory; exact fix versions are enumerated in the Huawei bulletins.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today