HarmonyOS CVE-2026-58553

The vulnerability requires local access to the affected HarmonyOS device (AV:L per CVSS vector); remote network-based exploitation is not supported by the current characterization. No privileges are specified as required (PR:N) and no user interaction is listed (UI:N), suggesting that any local process or user capable of triggering image decoding - whether via file placement or automated service invocation - can reach the vulnerable code path. The condition limiting exploitation is local access: an attacker must be physically present, have a shell session, or be able to deliver a file processed automatically by a codec-consuming service. Exploitation is constrained to service availability disruption (A:L), though the confidentiality discrepancy between the description and CVSS C:N metric remains unresolved. No specific non-default configuration or feature-flag requirement is identified in the available data.

The vendor-assigned CVSS 3.1 base score is 4.0 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating local attack vector, low complexity, no privileges required, no user interaction, and low availability impact only. A notable inconsistency exists: the CVE description explicitly states the vulnerability 'may affect service confidentiality,' yet the CVSS vector encodes C:N. Analysts should flag this discrepancy - out-of-bounds reads typically do expose memory contents and carry some confidentiality risk, suggesting the C:N assignment may understate impact. The local attack vector (AV:L) substantially limits real-world risk; exploitation is not remotely triggerable in its current characterization. EPSS data is not available in the provided intelligence. KEV status is negative - no confirmed active exploitation. The combination of local-only access, medium CVSS score, no public exploit, and no KEV listing places this in a lower operational priority tier, though the confidentiality discrepancy should be resolved with vendor clarification before fully discounting it.

A local attacker with access to a HarmonyOS device - through physical possession or an existing low-privilege session - delivers a specially crafted image file designed to trigger the out-of-bounds read in the codec module. When the image is processed by a gallery application, messaging client, or any system service that invokes the vulnerable codec, the overread causes the affected service to crash, resulting in a temporary availability loss. No public exploit code or proof-of-concept has been identified at time of analysis.