HarmonyOS CVE-2026-58552

Exploitation requires local code execution on a HarmonyOS device, confirmed by the CVSS AV:L metric - the attacker must have an application running on the device. No elevated privileges are required (PR:N), meaning a standard installed application with no special permissions can trigger the image codec path; no user interaction is needed beyond the attacker's own process (UI:N). The vulnerable component is the image codec module, so any application pathway that submits image data to the system codec - including gallery, messaging, or browser apps triggering codec parsing - is a potential trigger surface. Exploitation is constrained to a read-only memory disclosure (I:N in CVSS); there is no write primitive or direct code execution capability from this flaw alone. Remote exploitation is not applicable given AV:L. The attack surface spans all HarmonyOS device form factors per the four advisory tracks.

The CVSS 3.1 base score of 5.1 (Medium) is consistent with a local, low-complexity, no-privilege-required memory disclosure: the local attack vector (AV:L) is the primary risk limiter, confining exploitation to code already executing on the target device. Confidentiality impact is partial (C:L) and availability impact is limited (A:L), with no integrity impact, ruling out direct code execution from this flaw alone. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is not present, meaning CISA has not confirmed active exploitation. No POC has been identified. The breadth of affected device form factors - spanning consumer smartphones, vision devices, wearables, and laptops - widens the aggregate exposure surface despite the local-only vector. Real-world risk is moderate: on a mobile platform, AV:L/PR:N means any third-party app can potentially trigger the codec path, making this more accessible than a traditional local privilege escalation requiring shell access, though the lack of write primitive limits its standalone impact.

An attacker distributes a malicious HarmonyOS application that internally submits a specially crafted image file to the system image codec module, triggering the out-of-bounds read. The codec reads beyond the intended buffer boundary, leaking adjacent memory contents - potentially including in-memory tokens, session credentials, or other sensitive application state - back to the calling process. No public exploit code has been identified at time of analysis, and the local attack vector requires the malicious app to be installed on the target device.