Huawei HarmonyOS CVE-2026-41960

Exploitation requires the following specific conditions: (1) Target device must run Huawei HarmonyOS or EMUI with the vulnerable calls application; (2) attacker must be able to send network traffic to the target (likely through the same network or internet-routable path); (3) user interaction is mandatory-the user must interact with the calls app in a way that triggers the vulnerable code path, such as opening a call, using call forwarding, or interacting with a call-related notification; (4) the calls application must be enabled and operational on the device. The vulnerability does NOT require prior authentication (PR:N) to the device or privileged account access. The high attack complexity (AC:H) reflects the difficulty in reliably triggering user interaction in conjunction with network delivery. Devices with the calls application disabled or in restricted mode may not be exploitable.

This vulnerability presents moderate real-world risk with several mitigating factors. The CVSS score of 5.8 (Medium) and scope change (S:C) indicate cross-boundary impact affecting confidentiality, integrity, and availability. However, the attack vector is not straightforward: AC:H (Attack Complexity: High) and UI:R (User Interaction: Required) substantially reduce exploitation probability compared to high-CVSS network-based vulnerabilities. The EPSS score is not provided, limiting quantitative exploitation likelihood assessment. The absence of CISA KEV status and no public POC identified suggests limited active exploitation at time of analysis, despite the vulnerability being reported by Huawei in their security bulletin. The Information Disclosure tag and CWE-200 classification confirm the primary impact is unauthorized data access rather than remote code execution or mass availability disruption. Organizations with Huawei/EMUI deployments should prioritize this based on information sensitivity and user population exposure to social engineering, but this is not a critical emergency patching scenario. The high attack complexity requirement (user interaction + network coordination) suggests opportunistic rather than widespread exploitation risk.

An attacker sends a specially crafted network request to a device running vulnerable HarmonyOS/EMUI. When a user interacts with the calls application (for example, by tapping a malicious link or accepting a call from a spoofed number), the permission control flaw is triggered, allowing the attacker to read sensitive call logs, contact information, or other call-related metadata without explicit user permission. The attacker then exfiltrates this information for identity theft, social engineering, or targeted harassment campaigns.