EUVD-2026-21804
GHSA-84fx-xj3c-r25h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local device access
-
DeliveryAuthenticate as local user
-
ExploitTrigger multi-mode input interaction
-
ExecutionCraft input to cause double free
-
PersistTrigger heap corruption
-
ImpactInformation disclosure or denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Impact | CVSS vector analysis reveals moderate real-world risk: attack vector is local (AV:L), attack complexity is low (AC:L), requires low privileges (PR:L), and needs user interaction (UI:R). The EPSS or exploitation probability data is not provided, limiting quantitative assessment. Notably, the vulnerability results in information disclosure (I:L) and high availability impact (A:H), but the authenticated requirement and user interaction prerequisite significantly limit exploitability. This is not a critical remote code execution or privilege escalation; rather, it is a localized memory corruption issue. Real-world risk depends on whether attackers can realistically trigger user interaction in multi-mode input workflows. Without KEV status or public POC confirmation, this appears to be a low-priority finding relative to its CVSS score. |
| Exploit ScenarioDerived | A local authenticated user on a HarmonyOS device crafts a specific interaction sequence in the multi-mode input system (e.g., rapid input mode switching or malformed input events) that triggers a double-free condition. This causes heap corruption, potentially leaking sensitive data from adjacent memory regions or crashing the input service, degrading device usability. The attack requires the user to already possess local authentication and actively perform the malicious input sequence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
Double free vulnerability in Huawei HarmonyOS multi-mode input system allows local authenticated users with user interaction to cause information disclosure and denial of service. The vulnerability affects availability through memory corruption, with a CVSS score of 5.6 indicating moderate risk. No public exploit code or active exploitation has been confirmed at time of analysis.
RemediationAI
Huawei users should immediately apply vendor-released security updates from the official Huawei consumer support bulletin at https://consumer.huawei.com/en/support/bulletin/2026/4/ for consumer devices or https://consumer.huawei.com/en/support/bulletinlaptops/2026/4/ for laptops. Exact patched versions are not specified in the provided advisory data; users must download patches directly from Huawei. Interim mitigations include restricting local access to HarmonyOS devices to trusted users and minimizing use of multi-mode input features until patches are applied. No workaround is specified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exists in HarmonyOS's multi-mode input subsystem and is classified as CWE-415 (Double Free). Double free vulnerabilities occur when memory is deallocated twice, leading to heap corruption that can trigger denial of service or information disclosure. The attack requires local access and authenticated privileges, suggesting the input system processes untrusted data from local authenticated sessions. The multi-mode input system likely handles various input modes (keyboard, touch, voice, etc.) and improper reference counting or cleanup logic in this handler creates the double-free condition.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
Primary rating from Vendor (huawei) · only source for this CVE.
CVSS VectorVendor: huawei
DescriptionCVE.org
Double free vulnerability in the multi-mode input system. Impact: Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Exploit-DB