Huawei HarmonyOS CVE-2026-41970

Exploitation requires: (1) authenticated user credentials (PR:L) - the attacker must have a valid user account on the target device or network, not unauthenticated; (2) adjacent network access (AV:A) - attacker and target must be on the same local network segment, precluding direct internet-based exploitation; (3) the distributed file system module must be active and accessible. Default HarmonyOS and EMUI configurations typically enable DFS for device synchronization and file sharing, but exploitation is NOT possible from arbitrary remote networks. Lack of user interaction requirement (UI:N) means the targeted user need not perform any action - a background request to the DFS module suffices.

CVSS score of 6.8 with adjacent network vector (AV:A) indicates moderate severity, but real-world risk is further constrained by authentication requirements (PR:L - low-privilege user required). EPSS exploitation probability data is not provided, limiting assessment of weaponization likelihood. Absence of KEV listing and public exploit code suggests limited demonstrated exploitation in the wild, though memory corruption vulnerabilities in file system modules are historically attractive attack targets. The integrity impact (I:L) and high availability impact (A:H) indicate potential for denial-of-service and data manipulation, but low confidentiality impact (C:L) reduces exposure of sensitive data. Critical limiting factor: attack requires both local network access AND authenticated credentials - this substantially reduces attack surface compared to network-exposed vulnerabilities. Risk priority depends on deployment context: critical for connected IoT/wearable devices on shared corporate networks; lower for isolated or home networks.

An authenticated user on the same local network as a Huawei smartphone running HarmonyOS crafts a malformed DFS write request targeting the vulnerable file system module. The module fails to validate buffer boundaries and writes attacker-controlled data beyond allocated memory, corrupting internal data structures. This causes the device to experience performance degradation, file system errors, or potential reboot, achieving denial-of-service impact.