What is the CVSS score of CVE-2026-58549?

CVE-2026-58549 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

HarmonyOS CVE-2026-58549

EUVD-2026-44653 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-07-15 huawei

GHSA-7jx7-gp8g-mrw7

Buffer Overflow Harmonyos Huawei

4.0

CVSS 3.1 · Vendor: huawei

Severity by source

Vendor (huawei) PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.1 MEDIUM

OOB read inherently risks memory disclosure (C:L), correcting the C:N assignment; AV:L and PR:N retained per description and supplied vector.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (huawei).

CVSS VectorVendor: huawei

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 12:45 vuln.today

DescriptionCVE.org

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

AnalysisAI

Out-of-bounds read in the HarmonyOS image codec module allows a local unprivileged user to disrupt service availability on affected Huawei devices. Huawei's own bulletin language references potential confidentiality impact, but the NVD CVSS vector assigns C:N and A:L only - a discrepancy that warrants attention. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk low despite the wide device footprint across Huawei phones, wearables, and laptops.

Technical ContextAI

The vulnerability resides in the image codec module of HarmonyOS (CPE: cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*), Huawei's proprietary operating system deployed across smartphones, tablets, smartwatches, and laptops. The assigned weakness is CWE-120 (Buffer Copy without Checking Size of Input - Classic Buffer Overflow), though the CVE description specifically characterizes the flaw as an out-of-bounds read, which aligns more closely with CWE-125. This discrepancy suggests either a mislabeled CWE or a codec flaw that involves both a read overrun and a downstream memory copy violation. Image codec modules typically parse complex binary formats (JPEG, PNG, HEIF, WebP); a missing or incorrect bounds check during decoding can allow a read cursor to advance past the allocated buffer, potentially leaking adjacent heap memory or causing a null/invalid dereference that crashes the media service.

RemediationAI

Apply the HarmonyOS security updates published in the July 2026 Huawei Security Bulletins. Separate advisories are available for smartphones (https://consumer.huawei.com/en/support/bulletin/2026/7/), vision/tablet devices (https://consumer.huawei.com/en/support/bulletinvision/2026/7/), wearables (https://consumer.huawei.com/en/support/bulletinwearables/2026/7/), and laptops (https://consumer.huawei.com/en/support/bulletinlaptops/2026/7/). Exact patched version numbers are not confirmed in the provided intelligence and must be verified in those advisories before deployment. Because the attack vector is local and requires processing a malformed image, a compensating control for unpatched devices is to restrict third-party or untrusted media file processing - for example, limiting media library sync from untrusted sources - though this has usability trade-offs. Given the low CVSS impact rating, patching within a standard patch cycle is appropriate rather than emergency deployment.