EUVD-2026-44657
GHSA-p93h-8pcw-45vc
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Image codec OOB reads typically require a user to open a crafted file (UI:R) and can leak adjacent memory (C:L), contradicting vendor's C:N and UI:N assignments.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AnalysisAI
Out-of-bounds read in HarmonyOS's image codec module allows a local attacker to cause service availability disruption, with the vendor description also noting potential confidentiality impact - a discrepancy with the CVSS C:N metric that warrants attention. All versions of Huawei HarmonyOS across consumer devices, vision products, wearables, and laptops are identified as affected per the July 2026 Huawei Security Bulletin. No public exploit code has been identified at time of analysis, and the medium CVSS score of 4.0 with a local attack vector limits real-world exploitation to scenarios with physical or local access to the target device.
Technical ContextAI
HarmonyOS (CPE: cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*) is Huawei's proprietary operating system deployed across smartphones, tablets, smartwatches, smart glasses, and laptops. The flaw resides in the image codec module - the component responsible for decoding image file formats (e.g., JPEG, PNG, HEIF). The root cause is classified as CWE-120 (Buffer Copy Without Checking Size of Input), a classic buffer overflow family defect. Notably, the CVE description characterizes this specifically as an out-of-bounds read rather than a write, which would more precisely align with CWE-125; the CWE-120 tag may reflect the underlying buffer management defect causing the read overrun. An out-of-bounds read in a codec allows the process to read memory beyond the allocated buffer, potentially exposing adjacent memory contents or causing a crash when an invalid address is dereferenced.
RemediationAI
Users should consult the Huawei July 2026 Security Bulletins - separately published for consumer devices, vision products, wearables, and laptops - to obtain exact patched firmware and OS versions. Patch availability per vendor advisory is indicated by the bulletin references, but specific fix version numbers are not confirmed from the provided data and must be verified directly at the linked bulletin pages. As a compensating control prior to patching, users can reduce exposure by avoiding the opening or automatic processing of untrusted or unsolicited image files (e.g., disabling auto-download of media in messaging applications), which limits the attack surface of the image codec module. Restricting physical and local access to affected devices mitigates the local attack vector entirely. No trade-off is introduced by avoiding untrusted media; auto-download restriction may affect messaging convenience.
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause syst
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today