HarmonyOS/EMUI CVE-2026-41973

Exploitation requires the attacker to have a locally executing process on the target device - most realistically, a malicious application installed on the HarmonyOS or EMUI device. The CVSS vector PR:N confirms no elevated OS privileges are required for the installed app to trigger the flaw; any sandboxed app can attempt the bypass. UI:N confirms no victim interaction (e.g., no tap or approval) is needed once the app is running. The primary limiting factor is the local attack vector (AV:L): the attacker cannot reach this vulnerability remotely over a network without first achieving app installation. Additionally, the low impact ratings (C:L/I:L/A:L) imply the permission bypass does not grant full device control - exploitation is bounded to whatever restricted resource the vulnerable call exposes. No specific configuration setting or non-default feature flag is identified in the description as a prerequisite; the flaw appears present in the default call-handling path.

The CVSS base score of 5.9 (Medium) reflects a constrained but real risk profile. The local attack vector (AV:L) significantly limits exploitability compared to network-exposed vulnerabilities - an attacker must have a foothold on the device, typically through a malicious application installed from an unofficial source or via prior compromise. However, PR:N and AC:L mean that once local access exists, exploitation requires neither elevated privileges nor complex setup, lowering the skill bar considerably. All three impact pillars (C:L/I:L/A:L) are assessed at low severity, consistent with a permission bypass that leaks limited data or disrupts specific functionality rather than achieving full system compromise. No EPSS score was provided in the input data - exploitation probability cannot be quantified. The absence from CISA KEV and lack of public POC suggest this is not currently being exploited in widespread campaigns. Overall, this is a medium-priority issue for HarmonyOS/EMUI deployments: not urgent for most enterprises, but relevant for high-assurance mobile environments where any unauthorized permission escalation by a sandboxed app is unacceptable.

A threat actor distributes a malicious application - potentially disguised as a utility or game - that, once installed on the victim's HarmonyOS or EMUI device, invokes privileged system calls without holding the required permissions. Because the permission control logic contains a business logic gap, the call is serviced rather than rejected, allowing the app to read restricted data, modify limited system state, or degrade the availability of specific device functionality. No public exploit code has been identified at time of analysis, so exploitation currently requires independent rediscovery of the permission bypass.