HarmonyOS Gallery CVE-2026-49301

Exploitation requires local access to a device running one of the affected HarmonyOS versions (4.0.0, 4.2.0, 4.3.0, or 4.3.1) or EMUI versions (14.0.0, 14.2.0, or 15.0.0) with the Gallery module active. The CVSS vector (AV:L/PR:N/UI:N) indicates that no elevated privileges and no user interaction are required - any app or process executing locally on the device, including one without media permissions, could invoke the vulnerable Gallery module code path and read protected content. Exploitation is bounded to confidentiality only; integrity and availability are unaffected (I:N/A:N). The SSVC non-automatable classification indicates the flaw cannot be trivially mass-exploited across device fleets without per-device local access. Remote exploitation over a network is not possible given the local attack vector.

The CVSS 6.2 base score is derived from a local attack vector (AV:L), low complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality impact (C:H) with no integrity or availability impact. The local-only vector substantially limits mass-exploitation potential despite the high C score. SSVC assessment corroborates this: exploitation status is confirmed as none, the flaw is classified non-automatable, and technical impact is partial - all three signals indicate a genuine but lower-urgency finding. The vulnerability is absent from the CISA KEV catalog, and no EPSS score was provided in the available input data, so probabilistic exploitation probability cannot be independently quantified. No proof-of-concept code has been identified. In aggregate, this is a real confidentiality risk for individual device users - particularly given the sensitive nature of personal photo libraries - but does not represent an imminent mass-exploitation threat.

A malicious application installed on an affected HarmonyOS or EMUI device - without having been granted Gallery or media access permissions - exploits the permission control flaw in the Gallery module to directly read the user's photos and media files. No public proof-of-concept code has been identified at time of analysis, and exploitation is constrained to local device access, requiring the attacker to first achieve app installation (e.g., via social engineering or a malicious app store). If the malicious app also holds network permissions, exfiltrated media content could be silently transmitted to an attacker-controlled server.