HarmonyOS EMUI CVE-2026-41977

Exploitation requires local access to the device (AV:L) - the attacker cannot exploit this remotely over a network. User interaction is required (UI:R), meaning a victim must perform some action on the device to trigger the vulnerable code path in the log service. No system privileges are needed by the attacker (PR:N), so this could be triggered by an unprivileged local user or a malicious app running in the user context. The specific triggering configuration within the log service is not detailed in available data. Exploitation is limited by the requirement for local presence and user interaction, ruling out remote or fully automated attack scenarios.

The CVSS base score of 5.0 (Medium) reflects a constrained threat profile: local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R), with low availability and integrity impact and no confidentiality impact. No EPSS score was provided, limiting probabilistic exploitation assessment. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, placing this in the lowest exploitation urgency tier. The primary real-world risk is a localized DoS against the log service on a device where an attacker already has physical or logical local access and can induce user interaction - for example, by delivering a malicious file or application that triggers the vulnerable log handling path. The changed scope is a noteworthy signal that downstream device components could be affected, which slightly elevates the practical impact beyond the raw CVSS sub-scores suggest. Overall, this is a medium-severity local issue unlikely to be mass-exploited but relevant in high-assurance or BYOD environments.

An attacker with local access to a HarmonyOS or EMUI device - for example, via a malicious sideloaded application - crafts input that triggers the log service to perform an integer arithmetic operation that overflows, corrupting internal state. The victim interacts with the device in a way that exercises the vulnerable code path (e.g., opening a file or launching an app), after which the log service enters an error state causing a denial-of-service and potentially affecting the integrity of adjacent components given the changed scope. No public exploit code has been identified at time of analysis.