Huawei HarmonyOS CVE-2026-41963

Exploitation requires all of the following: (1) local authenticated access to the HarmonyOS device (the attacker must have a user account or physical access to unlock the device), (2) the ability to place a crafted media file on the device (via email attachment, USB transfer, messaging app, or cloud storage), (3) user interaction - the target user must actively open the malicious media file in a media application such as the Gallery, Music, or Video player. Non-default configuration is not required; the vulnerability affects default HarmonyOS installations. The impact is strictly limited to denial of service (application crash) and does not permit code execution, privilege escalation, or data exfiltration. Users who do not open untrusted media files are not at risk.

This vulnerability presents LOW real-world risk despite being catalogued by Huawei. CVSS 2.8 reflects the constrained attack surface: AV:L (local only, not remotely exploitable), PR:L (requires authenticated user account), UI:R (requires user to open/interact with malicious media), and S:U (impact limited to the user's session). The impact is degraded to availability only (A:L), eliminating integrity and confidentiality concerns that would elevate risk. EPSS data is not provided, but the low CVSS combined with local+authenticated+user-interaction requirements suggests minimal exploitability in practice. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code is referenced. Real-world exploitation would require an attacker to already have local system access or convince a user to open a malicious media file - a combination unlikely to be the attack vector of choice for threat actors who could achieve local code execution through other means. This is not a vulnerability requiring urgent patching for most organizations, though HarmonyOS device users should apply updates as part of normal patch management.

A local attacker with a user account on a HarmonyOS device creates a malicious media file (audio, video, or image) crafted to overflow the media platform's stack buffer during parsing. The attacker tricks or socially engineers a legitimate user into opening the file via the device's media player or gallery application. Upon opening, the stack overflow causes the media application to crash, resulting in temporary service unavailability and loss of media playback functionality until the device is restarted or the application is force-closed.