Huawei HarmonyOS CVE-2026-34853

Exploitation requires reaching the LBS (Location-Based Services) module's permission-checked interface on a Huawei HarmonyOS or EMUI device; for a CWE-270 permission bypass on a mobile OS this realistically means attacker-controlled code already running locally (an installed or compromised app), though the supplied CVSS vector asserts AV:N/PR:N and the description does not state the trigger or whether any feature must be enabled. Limiting factors: impact is confined to availability (no data disclosure or modification - C:N/I:N), the device must run an affected baseline (HarmonyOS 4.0.0/4.2.0/4.3.0/4.3.1 or EMUI 14.0.0/14.2.0/15.0.0), and SSVC marks the issue not automatable with no observed exploitation, so at-scale or remote mass exploitation is not indicated by the evidence.

Signals conflict on a key point. The supplied CVSS:3.1 vector rates this 7.5 High with AV:N/AC:L/PR:N/UI:N and A:H (availability-only; C:N/I:N), implying remote, unauthenticated, low-complexity impact. However, the affected products are mobile/device operating systems (Huawei HarmonyOS and EMUI) and the flaw is a permission bypass in the LBS (Location-Based Services) module mapped to CWE-270 - a class that is normally exercised by a locally installed/running application abusing the permission model, not reached across the network. The AV:N label is therefore questionable and should be verified against the Huawei bulletin; if the real vector is local, the 7.5 overstates reachability. The other signals all point to low real-world urgency: EPSS is 0.01% (0th percentile), SSVC reports Exploitation: none and Automatable: no, there is no CISA KEV listing and no PoC reference in the input. SSVC Technical Impact is 'total,' consistent with A:H. Net: this is a genuine availability defect in a very widely deployed consumer OS, but with no observed exploitation, negligible exploitation probability, and no automatability it reads as a patch-in-cycle item rather than an emergency; the vendor priority label is 'this_week.' Confidence-limiting caveat: the one-line description does not state the trigger, so the mechanism and true attack vector are not independently confirmable from the available sources.

A malicious or compromised application installed on a Huawei HarmonyOS or EMUI device abuses the permission bypass in the LBS module to perform a location-service operation it should not be permitted to, driving the service into a failure state. The result is a denial of service (availability loss, Technical Impact 'total' per SSVC); confidentiality and integrity are unaffected. No public exploit code or PoC reference is present in the supplied data, and the exact trigger is not described in the available sources.