What is the CVSS score of CVE-2026-34858?

CVE-2026-34858 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Harmonyos CVE-2026-34858

EUVD-2026-21836 MEDIUM

Race Condition (CWE-362)

2026-04-13 huawei

Information Disclosure Race Condition Harmonyos Huawei

4.1

CVSS 3.1 · Vendor: huawei

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local privilege escalation
Delivery

Access communication module
Exploit

Trigger race condition
Execution

Cause use-after-free
Persist

Exhaust system resources
Impact

Deny service

Vulnerability Assessment

Weakness	CWE CWE-362 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Concurrency control, locking MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) indicates this is a low-risk local attack requiring high privileges, high complexity, and producing only denial-of-service impact with no confidentiality or integrity breach. The 4.1 score reflects these constraints. However, the race condition nature (CWE-362 paired with use-after-free) introduces practical exploitation difficulty-timing windows are narrow and may require environment-specific tuning. KEV status is not confirmed and no public POC exists, further reducing real-world priority despite the availability impact. For most organizations, this is a low-to-medium priority patch candidate only if the affected HarmonyOS version is deployed in high-availability contexts where denial of service carries operational cost.
Exploit ScenarioDerived	An attacker with high-privilege local access to a HarmonyOS device (e.g., a malicious system service or privileged app) triggers a race condition in the communication module by repeatedly calling module functions in rapid succession. Under specific timing conditions, the attacker causes the module to reference memory that has been freed, leading to a crash or service unavailability. Exploitation requires precise timing and knowledge of the internal module implementation, making casual exploitation unlikely without reverse-engineering effort.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 13, 2026

Use-after-free vulnerability in Huawei HarmonyOS communication module allows authenticated local attackers with high privileges to cause denial of service through a race condition. CVSS score of 4.1 reflects low attack complexity and local-only vector, though availability impact is significant. No public exploit code or active exploitation confirmed at time of analysis.

RemediationAI

Users should consult Huawei's official security bulletins at https://consumer.huawei.com/en/support/bulletin/2026/4/ (consumer devices), https://consumer.huawei.com/en/support/bulletinvision/2026/4/ (vision devices), and https://consumer.huawei.com/en/support/bulletinwearables/2026/4/ (wearables) for available patches and update instructions. Check the applicable bulletin for your device type and HarmonyOS version, then apply the recommended firmware update. Until patched, restrict high-privilege local access to affected HarmonyOS devices where feasible, though this control is difficult to enforce on consumer devices without specialized device management.

Affected VersionsENISA

HarmonyOS 5.1.0

HarmonyOS 6.0.0

Affected Packages

euvd harmonyos no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the communication module of Huawei HarmonyOS and is rooted in a race condition (CWE-362) that results in a use-after-free memory safety error. Race conditions occur when multiple threads access shared memory without proper synchronization, allowing one thread to free memory while another thread attempts to use it. In this communication module context, timing-dependent access to freed memory objects can lead to unpredictable behavior and resource exhaustion. The affected product is identified via CPE cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* spanning all versions of HarmonyOS across consumer devices.

Know when Harmonyos gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (huawei) PRIMARY 4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (huawei) · only source for this CVE.

CVSS VectorVendor: huawei

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 100% exploitable

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +20

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).