Huawei HarmonyOS CVE-2026-41974

Local access to the device is required (AV:L) - remote exploitation is not possible per the CVSS vector. The attacker requires no system privileges (PR:N) but must induce user interaction with a notification-related UI element (UI:R), meaning purely background or silent exploitation is not feasible. The vulnerability is specifically within the service notifications component, so applications or scenarios that do not interact with the HarmonyOS/EMUI notification permission subsystem are not affected. The Changed Scope attribute implies an impacted component beyond the notification handler itself, but the specific downstream component is not identified in available data. Exploitation is limited by the requirement for physical or logical local access, mandatory user interaction, and a restricted availability-only impact with no path to code execution, credential theft, or data exfiltration based on the CVSS vector.

The overall risk posture is low. The CVSS base score of 3.6 reflects a constrained attack surface: local access is required (AV:L), no privileges are needed (PR:N), but user interaction must occur (UI:R), and the availability impact is only partial (A:L) with no confidentiality or integrity exposure. The Changed Scope (S:C) slightly elevates concern beyond a purely contained flaw, as the effect crosses component boundaries, but the concrete outcome remains a limited availability disruption rather than code execution or data exposure. No EPSS score was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC or active exploitation evidence is present. The tags indicate Privilege Escalation context, but the CVSS vector grants no privilege gain - this label likely refers to abuse of notification permission channels rather than OS-level privilege escalation. This discrepancy between the 'Privilege Escalation' tag and the CVSS C:N/I:N/A:L outcome should be verified against the Huawei advisory. In aggregate, this is a low-priority finding absent in-context factors such as high-value device fleets or chaining with other vulnerabilities.

A locally executing malicious application on a HarmonyOS or EMUI device lures the device user into interacting with a crafted notification (fulfilling the UI:R requirement), which triggers the permission control flaw in the notifications service. The exploit crosses a scope boundary to partially disrupt availability of a related system component, such as suppressing legitimate notifications or destabilizing the notification service for other applications. No public exploit code has been identified at time of analysis.