HarmonyOS CVE-2026-41981

Exploitation requires local authenticated access to the HarmonyOS device with at minimum low-privilege credentials, as confirmed by CVSS PR:L and AV:L. The attacker must be able to interact with the IPC module - achievable by any locally executing process or installed application with standard user permissions. No network-based exploitation path is indicated; remote attackers cannot exploit this without first obtaining local access through another vector. No special configuration or non-default feature enablement is specified in the description. Exploitation is limited to users, applications, or malicious code already running on the affected device, and impact is further bounded by the unchanged scope (S:U), meaning successful exploitation cannot directly pivot to other system components or cross privilege boundaries beyond what PR:L already affords.

The CVSS 3.1 base score of 5.3 (Medium) is consistent with the vector breakdown: local attack surface (AV:L) sharply limits exploitability compared to network-exposed vulnerabilities, low complexity (AC:L) means no special conditions beyond access are required, and low privileges (PR:L) means any authenticated local user or process could attempt exploitation. Scope is unchanged (S:U), containing impact to the vulnerable component. CIA impact is uniformly Low, suggesting the overflow may corrupt limited memory rather than enabling full control. No EPSS data was provided; without it, statistical exploitation probability cannot be assessed. No CISA KEV listing and no public POC have been identified, indicating this is not currently under widespread active exploitation. The combination of local access requirement and low CIA impact makes this a realistic but not urgent priority - organizations with restricted device access policies face materially lower risk. The wildcard CPE version string means all HarmonyOS versions are nominally flagged; exact patched version boundaries are unconfirmed from available data.

A low-privileged local user or malicious application on a HarmonyOS device constructs a crafted IPC message payload designed to overflow a heap buffer in the IPC module's message handling path. The overflow corrupts adjacent heap memory, potentially enabling the attacker to read sensitive data from adjacent allocations, tamper with IPC message integrity, or crash the IPC service causing localized availability loss. No public proof-of-concept code exists at time of analysis.