HarmonyOS Contacts CVE-2026-41961

The vulnerability requires local access to the HarmonyOS device (AV:L). No special privileges or authentication are required (PR:N), meaning any app or local user account can potentially trigger it. The contacts application must be present on the device and functional (default condition on all HarmonyOS devices). No user interaction is required (UI:N), so the exploit can execute silently without the user's knowledge. The vulnerability is most easily exploited by installed applications with no or minimal permission declarations, or by processes running with standard user-level privileges. Direct exploitation limits exploitation to the local device only; no network-level conditions restrict exploitation.

This vulnerability presents moderate real-world risk with several mitigating factors. The CVSS score of 5.9 reflects a local attack vector (AV:L), which requires existing access to the device-a significant practical barrier compared to network-based vulnerabilities. The lack of user interaction (UI:N) and no required privileges (PR:N) make it exploitable by unprivileged local apps or processes. However, the scope is unchanged (S:U), limiting lateral impact. The primary threat is information disclosure combined with low availability impact, not remote code execution or full system compromise. The absence of KEV listing, public POC, or EPSS data suggests this is not yet actively exploited at scale or considered an immediate threat. The vulnerability's real-world severity depends heavily on the threat model: in multi-tenant enterprise environments or devices with untrusted apps, unauthorized contact access poses compliance and privacy risks. In consumer scenarios with controlled app sources, the practical risk is lower. The permission control nature suggests this could affect multiple contact-handling features, potentially including export, sync, or third-party integration endpoints.

An unprivileged malicious app installed on a HarmonyOS device exploits the permission control vulnerability to read the user's contact list without triggering permission prompts or requiring explicit authorization. The app exfiltrates contact names, phone numbers, and email addresses to a remote server. Alternatively, an attacker with local shell access to the device could directly invoke the vulnerable contacts service to modify or delete critical contacts, causing availability issues for emergency services or important contacts.