HarmonyOS CVE-2026-41975

Exploitation requires all four of the following prerequisites simultaneously: (1) local access to the HarmonyOS device - remote network exploitation is not possible per AV:L; (2) a low-privileged authenticated account or installed application context on the device (PR:L); (3) user interaction with the malicious component (UI:R), such as tapping a prompt or triggering a UI event; and (4) high-complexity environmental conditions (AC:H), likely a specific timing window, race condition, or precise state in the network management module. Limiting factors for defenders: remote attackers are categorically excluded, unauthenticated access is excluded, and the high complexity substantially reduces reliable repeatability. The specific network management feature or configuration setting that must be active is not disclosed in the available advisory data.

The CVSS 6.3 Medium score is credible given the attack vector breakdown: AV:L (local access required), AC:H (high complexity - likely involving race conditions or specific timing), PR:L (low-privileged authenticated account required), and UI:R (victim must interact). The scope is unchanged (S:U), meaning the vulnerability cannot pivot to other system components. Despite C:H and A:H impacts, the combination of local-only access, high complexity, and mandatory user interaction substantially narrows the exploitable population in practice. No EPSS score was provided in the intelligence data, and this CVE has no CISA KEV listing and no known POC - both signals of limited in-the-wild exploitation pressure at time of analysis. The 'Information Disclosure' tag aligns with C:H. The low integrity impact (I:L) suggests the attacker can influence but not fully control network configuration data. Real-world risk is moderate for targeted on-device attacks (e.g., malicious apps with INTERACT_ACROSS_PROFILES-style abuse), but mass exploitation is implausible given local access and AC:H requirements.

An attacker installs a malicious application on a target HarmonyOS device under a low-privileged user account, then engineers a scenario - such as a deceptive UI prompt - that causes the victim to interact with the app in a way that triggers the permission management flaw in the network management module. Under the high-complexity conditions required, the malicious app gains unauthorized read access to sensitive network configuration or credentials (C:H) and may disrupt network service availability (A:H). No public exploit identified at time of analysis, and the AC:H rating suggests reliable exploitation requires specific environmental timing or configuration conditions.