EUVD-2026-44656
GHSA-rppv-cc33-x627
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Local attack vector confirmed by description; PR:N as any installed app can invoke the codec; no integrity impact since the flaw is read-only; A:L retained for potential codec crash.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AnalysisAI
Out-of-bounds read in HarmonyOS's image codec module exposes partial memory contents to local attackers, affecting service confidentiality with a secondary availability impact. The CVSS vector (AV:L/PR:N) scopes exploitation to the local device - reachable by any installed application capable of submitting image data to the vulnerable codec - without requiring elevated privileges. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code have been identified at time of analysis; Huawei has published remediation bulletins across four device categories in July 2026.
Technical ContextAI
HarmonyOS is Huawei's proprietary operating system deployed across smartphones, smart vision products, wearables, and laptops, as evidenced by four distinct July 2026 advisory bulletin tracks. The vulnerability resides in the image codec module - the subsystem responsible for decoding image formats such as JPEG, PNG, or proprietary formats. The assigned CWE-120 (Buffer Copy Without Checking Size of Input) denotes a classic buffer handling failure; however, the described impact is an out-of-bounds read, which more precisely aligns with CWE-125. This discrepancy suggests the root cause may be insufficient bounds validation when reading encoded image data into a buffer, allowing reads beyond the allocated region and potentially exposing adjacent heap or stack memory. The CPE string cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* uses a full wildcard, indicating all tracked HarmonyOS versions are potentially affected with no minimum floor or maximum ceiling specified by NVD.
RemediationAI
Apply the July 2026 Huawei security update appropriate to your device category: smartphone and consumer device users should consult https://consumer.huawei.com/en/support/bulletin/2026/7/, smart vision device users should refer to https://consumer.huawei.com/en/support/bulletinvision/2026/7/, wearable users should check https://consumer.huawei.com/en/support/bulletinwearables/2026/7/, and laptop users should review https://consumer.huawei.com/en/support/bulletinlaptops/2026/7/. Exact patched version numbers are not independently confirmed from the provided data - the bulletins are the authoritative source for specific build numbers. As a compensating control prior to patching, restricting installation of untrusted third-party applications via device management policy limits the local attack surface, since exploitation requires local code execution; note that this may reduce device functionality for users relying on third-party app ecosystems.
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause syst
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today