EUVD-2026-74612
GHSA-8mmc-cqvx-vp2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local device access (ADB/app/physical)
-
DeliveryInteract with input device module interface
-
ExploitSend malformed input exploiting CWE-264 flaw
-
ExecutionTrigger scope-crossing fault in dependent privileged component
-
PersistCrash target component
-
ImpactDevice or subsystem unavailability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission and access control
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local access to the target device is required (AV:L); no special privileges are needed (PR:N), meaning any locally executing process or user account can trigger the flaw. No user interaction is required (UI:N), so exploitation can be automated once local access is established. Exploitation is limited to physical or authenticated shell access to the device. Affected configurations span HarmonyOS 4.x and EMUI 14.x through 16.x; devices running patched firmware per the September 2026 bulletin are not affected. Remote exploitation is not indicated by the CVSS vector. The impact is purely availability - confidentiality and integrity are not compromised. |
| Impact | The CVSS base score of 7.1 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects a local, low-complexity, no-privileges-required denial-of-service with scope change. The combination of PR:N and AV:L indicates any local process or user - without elevated privileges - can trigger the crash, which lowers the barrier to exploitation on rooted or developer-mode devices. The scope change elevates severity above a typical local DoS. However, real-world risk is moderated by the requirement for local access: remote exploitation is not indicated. No public exploit code has been identified, EPSS data is not provided in the input, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. The impact is strictly availability-only (C:N/I:N), so there is no data exfiltration or persistence risk. Priority is moderate for enterprise mobile device management (MDM) fleets where Huawei devices are deployed; lower for most Western enterprise environments where Huawei device footprint is limited. |
| Exploit ScenarioDerived | An attacker with local access to a vulnerable Huawei device - either through an installed malicious application, ADB shell access, or physical console - sends malformed or unexpected input data to the input device module. The access control deficiency (CWE-264) allows this unprivileged input to trigger a fault in a scoped dependent component, crashing it and rendering the device or a critical subsystem unavailable. No public proof-of-concept exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Denial-of-service in Huawei HarmonyOS and EMUI's input device module allows a local unprivileged attacker to crash affected system components, impacting device availability. The CVSS scope change (S:C) indicates the flaw propagates availability impact beyond the vulnerable input module itself, potentially affecting higher-privileged or dependent subsystems. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
RemediationAI
Apply the security updates referenced in the Huawei September 2026 security bulletin (https://consumer.huawei.com/en/support/bulletin/2026/9/). Exact patched version numbers are not specified in the available data and should be confirmed directly from the bulletin. Device owners should use Huawei's OTA update mechanism to apply the latest available firmware for their HarmonyOS or EMUI version. As a compensating control where immediate patching is not possible, restricting untrusted or third-party applications from running locally on managed devices reduces the local-access attack surface; however, this does not eliminate the risk if an attacker already has local shell access. Physical device access controls (e.g., device lock, MDM enrollment) limit exploitation opportunity given the AV:L requirement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the input device module of Huawei's HarmonyOS and EMUI mobile operating system platforms, as confirmed by CPE strings cpe:2.3:a:huawei:harmonyos and cpe:2.3:a:huawei:emui. CWE-264 (Permissions, Privileges, and Access Controls) classifies the root cause as an access control deficiency in handling input device interactions, which is somewhat loosely applied here given the pure availability impact. The S:C (Scope Changed) in the CVSS vector is notable: it suggests the vulnerable input module component can trigger a failure in a separate, higher-privileged system component - consistent with a privileged input driver or kernel-adjacent service processing malformed input from an unprivileged caller. The attack vector is strictly local (AV:L), requiring physical or shell access to the device.
Know when Emui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Local vector confirmed by input device module context; PR:N as unprivileged callers can interact with input subsystem; S:C reflects crash propagating to a scoped dependent component; A:H only.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
DescriptionCVE.org
DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.
Executive ViewAI
Huawei HarmonyOS and EMUI devices are vulnerable to a denial-of-service attack that local attackers can exploit to crash system components and potentially render devices unavailable. No public exploit identified at time of analysis. With no vendor patch currently available, affected organizations must prioritize device access controls, incident monitoring, and preparation for emergency patching upon vendor patch release.
Restrict local physical access to devices to trusted personnel only; implement device management monitoring for unexpected reboots, system crashes, or availability degradation; and establish vendor advisory subscriptions for immediate patch notification upon availability. If operationally feasible, disable non-essential input device features to reduce attack surface pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to pr
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause syst
Exploit-DB