Skip to main content

Huawei HarmonyOS CVE-2026-41960

| EUVDEUVD-2026-30522 MEDIUM
Information Exposure (CWE-200)
2026-05-15 huawei GHSA-xp9m-hqhq-462q
Information Disclosure Emui
5.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.8 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
May 15, 2026 - 10:30 vuln.today
CVE Published
May 15, 2026 - 09:20 nvd
MEDIUM 5.8

DescriptionCVE.org

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

A permission control vulnerability in Huawei HarmonyOS and EMUI allows remote attackers to disclose sensitive information and potentially degrade system availability through unauthenticated network access combined with user interaction. The vulnerability stems from insufficient permission validation in the calls application, enabling attackers to read confidential data (CWE-200: Information Exposure) across system boundaries when users are socially engineered into triggering the malicious action.

Technical ContextAI

The vulnerability exists in the calls application within Huawei HarmonyOS and EMUI operating systems. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper access controls that fail to restrict sensitive data access to authorized principals only. The affected CPE entries (cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* and cpe:2.3:a:huawei:emui:*:*:*:*:*:*:*:*) suggest the vulnerability affects multiple versions of both operating systems. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the vulnerability requires network access, high attack complexity, no prior privileges, and user interaction-consistent with a permission-bypass scenario where an application mishandles inter-process communication or capability delegation in the calls subsystem.

RemediationAI

Update to the patched version of Huawei HarmonyOS and EMUI as provided in Huawei's security bulletin (https://consumer.huawei.com/en/support/bulletin/2026/5/). Check the bulletin for exact patched version numbers for your specific device model and operating system variant. Until patches are applied, implement application-level mitigations: disable unnecessary call app permissions at the system level if the calls application supports granular permission controls, restrict the calls app from accessing sensitive system data through Android/HarmonyOS security settings, and educate users to avoid granting permissions to unknown or suspicious applications requesting calls-related functionality. Disable network-facing call forwarding or call screening features if they are not actively required, as these may increase attack surface. Note that disabling legitimate features may impact telephony functionality, so balance security against operational requirements.

More in Emui

View all
CVE-2024-32991 CRITICAL
9.8 May 14

Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
CVE-2023-46773 CRITICAL
9.8 Dec 06

Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2023-44116 CRITICAL
9.8 Oct 11

Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this

CVE-2023-44105 CRITICAL
9.8 Oct 11

Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
CVE-2023-44106 CRITICAL
9.8 Oct 11

API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
CVE-2023-41297 CRITICAL
9.8 Sep 25

Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
CVE-2023-39405 CRITICAL
9.8 Aug 13

Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-37242 CRITICAL
9.8 Jul 06

Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
CVE-2023-34159 CRITICAL
9.8 Jun 19

Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to pr
CVE-2022-46327 CRITICAL
9.8 Dec 20

Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
CVE-2022-46326 CRITICAL
9.8 Dec 20

Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2022-46325 CRITICAL
9.8 Dec 20

Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause syst

Same weakness CWE-200 – Information Exposure

View all
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2016-2388 MEDIUM POC
5.3
CVE-2016-1561 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-41960 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy