EUVD-2026-44655
GHSA-85pp-f9jm-8fg8
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Image codec flaws require a crafted file to be opened or indexed, implying UI:R; all other metrics match the vendor-provided vector.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AnalysisAI
Out-of-bounds read in HarmonyOS's image codec module exposes limited memory content and may cause service instability, affecting confidentiality and availability at a low severity level. The flaw resides in image processing logic and is reachable by a local, unprivileged actor who can trigger image decoding - such as by supplying a crafted image file. No public exploit has been identified at time of analysis, and Huawei has disclosed patches via July 2026 security bulletins covering consumer devices, wearables, and laptops.
Technical ContextAI
HarmonyOS is Huawei's proprietary operating system deployed across a broad device portfolio including smartphones, smartwatches, and laptops - all referenced in the advisory bulletins. The vulnerable component is the image codec module, responsible for decoding image formats (e.g., JPEG, PNG, or proprietary formats). The assigned CWE is CWE-120 ('Classic Buffer Overflow'), though the description specifies an out-of-bounds read, which more precisely aligns with CWE-125. This discrepancy may indicate a classification error or that the same improper buffer boundary checking function produces both read overruns and potential write overruns depending on input. In either case, the root cause is the absence of proper bounds validation when processing image data, allowing reads beyond the allocated buffer boundary. The CPE string cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* covers all versions of HarmonyOS as a software application product, with no version floor or ceiling specified in the available data.
RemediationAI
Users and administrators should consult the Huawei July 2026 security bulletins for their respective device class and apply available over-the-air (OTA) or manual firmware updates: consumer devices at https://consumer.huawei.com/en/support/bulletin/2026/7/, Vision devices at https://consumer.huawei.com/en/support/bulletinvision/2026/7/, wearables at https://consumer.huawei.com/en/support/bulletinwearables/2026/7/, and laptops at https://consumer.huawei.com/en/support/bulletinlaptops/2026/7/. Exact patched version numbers are not confirmed from the provided data and should be verified directly against the bulletin. As a compensating control where patching is delayed, restricting untrusted image file input to affected devices - for example, blocking image sharing from untrusted sources via MDM policy or disabling automatic media indexing - reduces the attack surface. These controls carry the trade-off of degraded user experience or reduced functionality but may be acceptable in high-sensitivity enterprise deployments of HarmonyOS laptops or shared devices.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today