HarmonyOS CVE-2026-41968

The vulnerability requires local access to an HarmonyOS device (AV:L). The attacker does not require elevated privileges (PR:N), meaning the vulnerability is exploitable by any local user with standard account access. The manufacturability design module must be present and functional on the target system; if this module is disabled or not installed, the vulnerability path may not be accessible. No special configuration or authentication mechanism is mentioned in the available data. The vulnerability is not exploitable remotely over network protocols-local presence is mandatory.

The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a local attack requiring low complexity and no user interaction, creating a straightforward exploitation path for any local user. However, the 5.9 CVSS score (medium) reflects bounded scope (single user context) and partial impacts across confidentiality, integrity, and availability. No public exploit code, CISA KEV status, or EPSS score was provided in the available data, limiting assessment of real-world exploitation likelihood and prevalence. The vulnerability's presence in a manufacturability module-potentially a specialized or less-deployed feature-may limit practical impact compared to core OS components. The permission control classification suggests this is a privilege escalation or access control bypass rather than memory corruption, reducing but not eliminating exploitability concerns. Without additional intelligence on exploitation activity or patch availability, this should be treated as a medium-priority vulnerability requiring patching within standard update cycles but not as an emergency security incident.

A local attacker with standard user privileges on an HarmonyOS device accesses the manufacturability design module and, due to insufficient permission controls, reads sensitive system information, modifies configuration data, and degrades availability through resource exhaustion or state corruption. The attack requires no special user interaction and succeeds on default system configurations. No public proof-of-concept exploit has been identified in the available data.