HarmonyOS CVE-2026-58550

Local access to a HarmonyOS device is required - AV:L confirms this is not remotely exploitable over a network. The CVSS vector records PR:N (no privileges required), meaning a standard unprivileged local user account is sufficient; no administrative or root access is needed. UI:N suggests no additional user interaction beyond the attacker's own actions is required once local access is obtained. The exploitation trigger is processing a specially crafted image file through the affected codec module; this limits the attack surface to code paths that invoke image decoding. The primary limiting factor is the local attack vector: remote exploitation is not possible under the stated CVSS metrics, and the confidentiality impact discrepancy (description vs. CVSS C:N) remains unresolved from available data.

The NVD-assigned CVSS 3.1 base score is 4.0 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. There is a notable internal inconsistency: the CVE description states the vulnerability 'may affect service confidentiality,' yet the CVSS vector records C:N (no confidentiality impact) - this conflict is unresolved in the available data and should be verified against the Huawei bulletin. The local attack vector (AV:L) substantially limits exploitability, requiring the attacker to have local access to the device. PR:N combined with AV:L suggests a logged-in but unprivileged user scenario. No EPSS score is available, no KEV listing exists, and no POC has been identified - all signals pointing to low immediate exploitation urgency. Real-world risk is constrained to local attack scenarios on HarmonyOS devices; this is not a remotely triggerable flaw under the stated vector. The confidentiality discrepancy between the description and the CVSS C:N metric is the most significant analytical uncertainty here.

A local, unprivileged user on a HarmonyOS device crafts or obtains a malformed image file designed to trigger the out-of-bounds read in the image codec module. When the image is processed - for example, via a gallery app or messaging client rendering an attachment - the codec reads past the end of an allocated buffer, potentially leaking adjacent heap contents or crashing the decoding service. No public exploit code has been identified at time of analysis.