HarmonyOS SMS CVE-2026-41972

User interaction is required (UI:R per CVSS vector) - the victim must open, preview, or otherwise interact with a crafted SMS message for the vulnerability to trigger. The attacker requires no authentication and no elevated privileges (PR:N), and can reach the target over the network (AV:N), meaning the attack can be initiated remotely by sending an SMS. Exploitation is limited by: (1) the mandatory victim interaction step, which prevents fully automated mass exploitation; (2) impact constrained to integrity and availability only, with no confidentiality impact (C:N); and (3) scope limited to the affected component (S:U). No special device configuration or non-default settings are indicated as prerequisites beyond having the HarmonyOS SMS application present and active.

The CVSS 3.1 base score of 5.4 (Medium) is derived from a network attack vector (AV:N), low attack complexity (AC:L), no required privileges (PR:N), required user interaction (UI:R), unchanged scope (S:U), no confidentiality impact (C:N), and low integrity and availability impact (I:L, A:L). The user interaction requirement (UI:R) is the primary practical barrier to exploitation and is the key differentiator from a higher-severity network-exploitable flaw - an attacker cannot trigger the vulnerability without the victim taking action, such as opening or previewing a crafted SMS. There is no EPSS score provided in the available data, no public POC, and no KEV listing, all of which suggest this has not been observed in widespread exploitation. The dual impact on integrity and availability (not confidentiality) limits the damage potential compared to vulnerabilities that expose data. Overall, this is a genuine but bounded risk - medium priority for enterprise mobile device management programs deploying HarmonyOS devices, lower priority in consumer contexts absent active exploitation evidence.

An attacker sends a crafted SMS message containing path traversal sequences to a target HarmonyOS device. When the victim opens or previews the message in the SMS app, the malicious payload triggers the CWE-22 path traversal, potentially allowing the attacker to write to or overwrite files outside the app's sandbox, degrading availability or modifying limited content. No public exploit code exists at time of analysis, so this scenario remains theoretical based on CVSS vector analysis.