What is the CVSS score of CVE-2026-41979?

CVE-2026-41979 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

HarmonyOS CVE-2026-41979

EUVD-2026-35329 MEDIUM

Weaknesses Introduced During Design (CWE-701)

2026-06-09 huawei

GHSA-vcvh-2xwm-mp64

Information Disclosure Harmonyos

5.5

CVSS 3.1 · Vendor: huawei

Severity by source

Vendor (huawei) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from Vendor (huawei) · only source for this CVE.

CVSS VectorVendor: huawei

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:19 vuln.today

DescriptionCVE.org

Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect integrity and confidentiality.

AnalysisAI

Permission control failure in the HarmonyOS print module allows a local attacker - without requiring elevated privileges - to compromise system integrity through user-triggered interaction. The vulnerability resides in Huawei's HarmonyOS, disclosed via the June 2026 Huawei Security Bulletin, and carries a CVSS 5.5 (Medium) rating. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, though the high integrity impact warrants attention in enterprise HarmonyOS deployments.

Technical ContextAI

The vulnerability affects the print module of Huawei HarmonyOS, identified via CPE cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*. The CWE assigned is CWE-701 ('Weaknesses Introduced During Design'), which is a high-level category/pillar rather than a specific weakness class - atypically broad for a CVE assignment. In context, the root cause is most consistent with improper access control or incorrect permission assignment within the print subsystem, likely a design-level failure to enforce permission boundaries when the print module processes or passes data. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates a locally exploitable flaw that requires user interaction but no pre-existing privileges, resulting in high integrity impact with no confidentiality or availability consequence. Notably, the 'Information Disclosure' tag in the source intelligence conflicts with the CVSS confidentiality score of C:N - this inconsistency should be verified against the vendor bulletin.

RemediationAI

Apply the patch or update referenced in the Huawei June 2026 Security Bulletin (https://consumer.huawei.com/en/support/bulletin/2026/6/ and the laptops equivalent at https://consumer.huawei.com/en/support/bulletinlaptops/2026/6/). No specific fixed version number was included in the available intelligence data, so administrators should consult those bulletins directly to obtain the precise patched release and apply it through Huawei's standard OTA or device management update mechanisms. As a compensating control where patching is not immediately possible, restricting or disabling access to the print module for untrusted or low-trust user sessions reduces the exploitable surface, though this will interrupt legitimate print functionality. Monitoring for unexpected permission changes or print module activity via system logs can serve as a detection measure while remediation is pending.