What is the CVSS score of CVE-2026-58555?

CVE-2026-58555 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

HarmonyOS CVE-2026-58555

EUVD-2026-44658 MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2026-07-15 huawei

GHSA-78h5-w2vg-67j7

Privilege Escalation Harmonyos

6.6

CVSS 3.1 · Vendor: huawei

Severity by source

Vendor (huawei) PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

vuln.today AI

6.6 MEDIUM

Local vector confirmed by card-module scope; PR:N because any unprivileged app can register a card; UI:R because victim interaction with the card is required to trigger the bypass.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (huawei).

CVSS VectorVendor: huawei

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 12:47 vuln.today

DescriptionCVE.org

Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

Permission bypass in the HarmonyOS card module allows a local, unprivileged user - with required user interaction - to circumvent access controls, resulting in high availability impact alongside limited confidentiality and integrity exposure. The vulnerability affects Huawei HarmonyOS across all tracked versions per CPE data and is documented in Huawei's July 2026 security bulletin. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk constrained to local attack scenarios.

Technical ContextAI

HarmonyOS (cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*) is Huawei's proprietary operating system used across smartphones, tablets, and laptops. The 'card module' refers to the widget or service-card subsystem that renders interactive cards on the home screen or notification surface - a common UI paradigm in HarmonyOS. The root cause is classified under CWE-264 (Permissions, Privileges, and Access Controls), indicating that the card module fails to properly enforce OS-level permission boundaries. This class of flaw typically arises when a module performs capability or permission checks incorrectly, allows permission inheritance to be abused, or skips mandatory access control gates under specific interaction conditions. The local attack vector (AV:L) confirms exploitation requires a presence on the device, consistent with a card or widget that can be installed or triggered by a local user or installed application.

RemediationAI

Consult the Huawei July 2026 security bulletins directly at https://consumer.huawei.com/en/support/bulletin/2026/7/ (for phones and tablets) and https://consumer.huawei.com/en/support/bulletinlaptops/2026/7/ (for laptops) to identify the exact patched HarmonyOS version and apply the available OTA update. The patch version is available per vendor advisory but was not independently confirmed in the provided data, so treat the bulletin as the authoritative source for the target firmware version. As a compensating control prior to patching, users should avoid installing or interacting with cards from untrusted third-party sources, since UI:R means user interaction with a triggering card is a required precondition; restricting card installation to verified sources reduces exposure without disabling functionality. Restricting third-party card or widget installation through device management policy is a viable enterprise mitigation with the trade-off of limiting home-screen customization.