HarmonyOS CVE-2026-58549

Exploitation requires local access to the HarmonyOS device and the ability to cause the image codec module to process a maliciously crafted image file; the CVSS vector confirms PR:N (no elevated privileges required) and UI:N (no additional user interaction beyond delivering the image). The attack is limited to devices running HarmonyOS across Huawei's product lines (phones, wearables, laptops, vision devices). The local-only vector (AV:L) means remote exploitation over a network is not directly possible; an attacker would first need a foothold on the device or a mechanism to force local media processing. Exploitation is further limited by the low impact scope (A:L, S:U), meaning a successful attack crashes or degrades the media service rather than compromising the broader OS or user data - assuming the CVSS C:N rating is accurate.

The NVD CVSS 3.1 score of 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) places this in the Medium band with a local-only attack vector, no privilege requirement, and impact limited to low availability. EPSS data is not provided, but the local vector and low availability impact suggest a negligible exploitation probability. No CISA KEV listing and no public POC have been identified, confirming this is not an actively targeted vulnerability at time of analysis. A notable data conflict exists: Huawei's description states the vulnerability 'may affect service confidentiality,' yet the CVSS vector records C:N - security teams should consult the July 2026 Huawei bulletins directly to resolve whether confidentiality impact was later downgraded or is absent by design. The low CVSS score is consistent with a read-only crash scenario rather than memory exfiltration. Overall, this is a low-priority vulnerability for most organizations; patching should follow normal release cycles rather than emergency response.

A local user on a HarmonyOS device opens or triggers the processing of a specially crafted image file - for example, through a messaging app or media library sync - causing the image codec module to perform an out-of-bounds read past the end of a decoded buffer. This results in a crash of the affected media service, temporarily denying availability of image-processing functionality. No public POC exists at time of analysis, and actual memory disclosure depends on whether the CVSS confidentiality rating or the vendor description language is authoritative.