HarmonyOS CVE-2026-41978

Exploitation requires the attacker to have local access to the affected HarmonyOS device - remote network-based exploitation is not possible per the AV:L vector. A legitimate user must interact with the clone module feature (UI:R), such as initiating an app or data clone operation; without this interaction, the vulnerable code path is not triggered. The vulnerability affects the clone module specifically, meaning deployments or configurations where clone functionality is disabled or unused are not exposed. Authentication requirements are not required for the attacker per the PR:N CVSS component, but local device presence is mandatory. Exploitation impact is bounded to low confidentiality and low availability - full data exfiltration or system compromise is not indicated.

The CVSS 3.1 base score of 4.4 (Medium) reflects the constrained nature of this vulnerability. The attack vector is Local (AV:L), meaning physical or logical local access to the device is a prerequisite, which substantially limits the attacker pool. No privileges are required (PR:N), but user interaction is mandatory (UI:R) - a legitimate user must perform some action (likely initiating a clone operation) for exploitation to occur. The scope is unchanged (S:U) and impacts are limited to low confidentiality (C:L) and low availability (A:L) with no integrity impact (I:N). No EPSS score was provided in the input data; without it, statistical exploitation likelihood cannot be quantified. There is no KEV listing and no known POC, which further reduces near-term risk. Overall, this is a constrained, low-impact vulnerability requiring local presence and user interaction - real-world exploitation would likely be limited to targeted scenarios, not opportunistic mass exploitation.

A local user on a HarmonyOS laptop device entices or waits for a legitimate user to initiate a clone operation within a target application. During this user-triggered action, the attacker exploits the improper permission checks in the clone module to read service data that should be inaccessible, resulting in limited confidentiality disclosure. No public exploit code exists at time of analysis, making this scenario most plausible in a targeted, insider-access context.