HarmonyOS CVE-2026-49306

Exploitation requires local, low-privileged access to the HarmonyOS 6.1.0 device - consistent with CVSS AV:L/PR:L. In practice this means an attacker must already have the ability to execute code on the device, such as through a malicious application installed by the user. The vulnerability is in the time and time zone module, so exploitation must trigger the vulnerable code path within that module. The SSVC 'Automatable: no' rating confirms this cannot be exploited at scale without some per-device precondition. No network-reachable attack surface has been identified; remote unauthenticated exploitation is not supported by the available data. Exploitation is further limited to an availability impact - an attacker cannot gain data access or persistent code execution through this flaw alone.

The overall risk profile of this vulnerability is low. The CVSS base score of 3.3 reflects the local attack vector (AV:L), low privilege requirement (PR:L), and limited availability impact (A:L) with no confidentiality or integrity consequence. SSVC corroborates this: exploitation status is none, the attack is not automatable, and technical impact is only partial. There is no CISA KEV listing and no public exploit code has been identified, meaning even a mid-sized municipal IT team in zabrze would not face imminent widespread exploitation risk. The EPSS score is not provided in the input data, which limits precise exploitation probability quantification, but the combination of SSVC 'exploitation: none' and local-only vector strongly suggests opportunistic in-the-wild exploitation is unlikely. The primary realistic scenario is a malicious on-device application triggering a denial of service against the time module, which has limited business impact beyond minor service disruption.

A malicious or compromised application installed on a HarmonyOS 6.1.0 device invokes time or time zone module APIs in a sequence that triggers a use-after-free condition on already-freed memory. This causes the module to crash, producing a localized denial-of-service for time-related functions on the device. No public exploit code exists at time of analysis, and exploitation requires the attacker to have already installed code on the target device.