Harmonyos CVE-2026-34861

The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) indicates local-only attack surface with high privilege requirement, reducing real-world attacker reach to users or software already possessing administrative capability. However, the high integrity impact (I:H) combined with availability impact (A:H) suggests potential for persistent system compromise beyond simple information leakage. The race condition's AC:L (low complexity) rating is significant-once a privileged attacker gains access, exploitation requires no special conditions or timing precision, making it reliably exploitable. No public exploit code, KEV listing, or EPSS score was provided; threat elevation depends on whether privilege escalation chains or supply-chain scenarios can precede this vulnerability. For managed devices or security-critical deployments, this warrants timely patching despite the privilege barrier; for consumer HarmonyOS devices, risk is moderate unless paired with prior compromise.

A privileged local user (e.g., system administrator or rooted application) spawns multiple threads that simultaneously read thermal sensor state and modify frequency scaling policies. By carefully timing concurrent requests to the thermal management interface, the attacker exploits the TOCTOU window to read sensor values before locks are acquired, obtaining device operational intelligence. Alternatively, an attacker could manipulate thermal thresholds during the race condition window to disable thermal protections, causing sustained overheating or triggering unintended system behavior.