HarmonyOS CVE-2026-41967

The vulnerability requires local system access (AV:L) - either physical device access or local code execution privileges (e.g., via a compromised application or adb shell access). No privilege escalation is required (PR:N), meaning any local user account or unprivileged process can attempt exploitation. The manufacturability design module must be accessible on the device; if this module is completely removed or disabled post-manufacturing on consumer devices, exposure is reduced to devices in development, testing, or special configurations. No special user interaction is required (UI:N), so exploitation occurs automatically once local access is achieved.

CVSS 5.9 indicates moderate risk with local scope limited to the affected system (S:U). The no-privilege requirement (PR:N) and low complexity (AC:L) mean any local user or application can exploit this without special conditions. However, real-world risk is constrained by local-only attack vector - this requires either physical device access or local code execution from a previously compromised application. EPSS data is not provided; without exploitation probability estimates or KEV status, severity assessment relies solely on CVSS indicators. The simultaneous impact on confidentiality, integrity, and availability (C:L/I:L/A:L) suggests this affects core device security boundaries. The 'manufacturability' context is notable: if this module is disabled or restricted post-manufacturing, real-world exposure may be limited to devices in production/testing environments or those with debug modes enabled. Data completeness is poor - vendor advisory URL is inaccessible (returns None), and no patch version, exploit code, or active exploitation data are provided.

An attacker with local device access installs a malicious application from an unofficial source. The application exploits the permission control vulnerability in the manufacturability design module to read sensitive data (such as device identifiers, encryption keys, or diagnostic information) without proper authorization. Alternatively, the attacker escalates privileges to modify system settings or disable security features by bypassing the inadequate permission checks in the manufacturability interface.