Huawei HarmonyOS CVE-2026-41980

Local access to the HarmonyOS device is required (AV:L) - remote network exploitation is not possible per the CVSS vector. User interaction is required (UI:R), meaning the victim must actively trigger a file preview operation, such as opening or previewing a file through the affected module. No account privileges are required by the attacker (PR:N), meaning a co-resident unprivileged application or local user without a system account can attempt exploitation. The specific file preview feature of HarmonyOS must be invoked for the vulnerability to be triggered. Exploitation is limited by the need for physical or logical local access to the device and the necessity of user interaction, preventing fully automated or remote attack chains.

The CVSS base score of 5.5 (Medium) is consistent with the local attack vector (AV:L) and mandatory user interaction (UI:R), which together substantially reduce exploitability compared to a remotely triggerable flaw. The high confidentiality impact (C:H) is the primary driver of the score, reflecting that sensitive file contents can be fully exposed. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, indicating no confirmed active exploitation. The PR:N component is notable: although local access is required, the attacker does not need an existing account with elevated privileges, lowering the barrier for malicious co-resident applications or rogue local users. Overall, this is a moderate-priority issue - real risk exists for devices exposed to untrusted local users or applications, but the local vector and required user interaction significantly limit mass exploitation.

A malicious application installed on the same HarmonyOS device, or a rogue local user, induces the victim to preview a targeted file - such as by sending a crafted file link or placing a file in a shared directory. When the HarmonyOS file preview module renders the file, it fails to enforce the correct permission boundary, exposing the contents of sensitive files (e.g., contacts, documents, credentials) to the attacker's context. No public exploit identified at time of analysis, so this scenario is theoretical but technically plausible given the low attack complexity (AC:L).