What is the CVSS score of CVE-2026-34856?

CVE-2026-34856 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Harmonyos are affected by CVE-2026-34856?

CVE-2026-34856 is a high-severity use-after-free vulnerability in Huawei HarmonyOS that allows local attackers to crash devices and potentially access sensitive information, affecting any…

How to fix or mitigate CVE-2026-34856?

Within 24 hours: Identify and inventory all HarmonyOS devices in production environments and assess which have local user access. Within 7 days: Implement access controls to restrict local authentication on affected devices and isolate high-risk systems from sensitive networks if feasible. Within 30 days: Monitor Huawei security advisories for patch release; apply vendor patch immediately upon availability and validate remediation across your HarmonyOS fleet.

Harmonyos CVE-2026-34856

EUVD-2026-21800 HIGH

Race Condition (CWE-362)

2026-04-13 huawei

GHSA-pvgc-rj6v-rx44

Information Disclosure Race Condition Harmonyos Huawei

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 05:03 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 04:24 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 04:15 euvd

EUVD-2026-21800

Analysis Generated

Apr 13, 2026 - 04:15 vuln.today

CVE Published

Apr 13, 2026 - 03:56 nvd

HIGH 7.3

DescriptionCVE.org

UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

Use-after-free in Huawei HarmonyOS communication module allows local attackers to cause denial of service and potentially disclose information without authentication. The vulnerability stems from a race condition (CWE-362) enabling memory corruption with high availability impact. EPSS data not available; no public exploit identified at time of analysis. Vendor has released security bulletin with remediation guidance.

Technical ContextAI

This is a use-after-free (UAF) memory corruption vulnerability in HarmonyOS's communication module, classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization - Race Condition). UAF vulnerabilities occur when a program continues to use a memory reference after it has been freed, creating a time-of-check/time-of-use (TOCTOU) race window. In concurrent execution environments like communication modules handling multiple threads or processes, improper synchronization can allow an attacker to manipulate freed memory before reallocation. The affected product is Huawei HarmonyOS (CPE 2.3:a:huawei:harmonyos), Huawei's distributed operating system used across mobile devices, wearables, and IoT products. The communication module likely handles inter-process communication, network protocols, or device-to-device connectivity where race conditions are most prevalent.

RemediationAI

Huawei has published official security bulletins with remediation guidance. Users should immediately review the appropriate bulletin: for HarmonyOS devices visit https://consumer.huawei.com/en/support/bulletin/2026/4/ and for HarmonyOS wearables visit https://consumer.huawei.com/en/support/bulletinwearables/2026/4/. Apply the vendor-supplied security updates through the device's system update mechanism as soon as available. The bulletins should specify exact patched versions for each affected device model. Until patching is complete, mitigating controls include restricting local device access to trusted users only, enabling device encryption and screen locks, and monitoring for unusual application behavior or unexpected system crashes that may indicate exploitation attempts. No effective workarounds exist for race condition vulnerabilities beyond applying the vendor patch.