Harmonyos CVE-2026-34860

This vulnerability presents a low-to-moderate real-world risk despite affecting confidentiality and availability. The CVSS score of 4.1 reflects multiple mitigating factors: local attack vector restricts exploitation to users with physical or local network access to a device, high attack complexity (AC:H) suggests the attacker must satisfy specific conditions or perform unusual actions, and required user interaction (UI:R) means the attack cannot execute automatically without user participation. The EPSS probability and exploitation status are not independently available in the provided data, but the absence of any reference to public exploit code or CISA KEV listing suggests this is not yet a priority threat in active campaigns. The scope changed (S:C) indicates the confidentiality and availability impact extends beyond the memo application itself, which elevates concern slightly, but the low CVSS score and local-only attack vector position this as a lower priority than network-exploitable flaws. Organizations should prioritize patch deployment for devices in regulated or sensitive environments but need not treat this as an emergency.

A local user on a HarmonyOS device with physical access (or gaining local network access via a compromised service) performs specific user interactions that bypass the memo module's access control checks, allowing them to read sensitive memo content stored by other users or system processes. Because high attack complexity is required, the attacker must either satisfy unusual preconditions, exploit a race condition, or manipulate the UI in a non-obvious way. The attack does not yield code execution or data modification but exposes confidential memo text and may temporarily degrade system availability if the memo module crashes during the attack.