What is the CVSS score of CVE-2026-41969?

CVE-2026-41969 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Huawei HarmonyOS CVE-2026-41969

EUVD-2026-30531 MEDIUM

Permission Issues (CWE-275)

2026-05-15 huawei

GHSA-7385-cj32-3rfx

Information Disclosure Emui

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 10:31 vuln.today

CVE Published

May 15, 2026 - 09:31 nvd

MEDIUM 6.2

DescriptionCVE.org

Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

AnalysisAI

A permission control vulnerability in the projection module of Huawei HarmonyOS and EMUI allows local attackers with physical access to bypass authorization checks and disclose sensitive information. The flaw affects confidentiality through improper permission enforcement in a physical-access attack vector requiring user interaction. No active exploitation has been confirmed, and patch availability has not been independently verified from the provided reference.

Technical ContextAI

The vulnerability resides in the projection module, a component responsible for wireless display and screen mirroring functionality in Huawei HarmonyOS and EMUI platforms. CWE-275 (Incorrect Default Permissions) indicates the root cause is improper initialization or enforcement of access control lists on a resource that should restrict projection capabilities to authorized users or processes. The physical attack vector (AV:P) and requirement for user interaction (UI:R) suggest the exploitation path involves local proximity to a device and some form of user engagement, potentially through touch interaction or a displayed prompt that the attacker manipulates.

RemediationAI

Apply security updates from Huawei's official support bulletin once a patched version is released and made available through Huawei's update channels. Users should monitor https://consumer.huawei.com/en/support/bulletin/2026/5/ for specific patch versions and deployment timelines. Until a vendor patch is available, implement compensating controls by disabling the projection feature in HarmonyOS and EMUI settings if wireless display functionality is not required; this eliminates the attack surface at the cost of losing screen mirroring and casting capabilities. Additionally, restrict physical device access in shared environments by storing devices in secure locations when unattended and educating users to reject unexpected projection requests from untrusted sources. Organizations should require users to disable Bluetooth and NFC wireless discovery when not actively using wireless features, reducing the likelihood that an attacker can initiate a projection session without user awareness.