HarmonyOS Bluetooth CVE-2026-58556

Exploitation requires that an attacker have the ability to execute code locally on the target device - either via a malicious app installed by the user, a previously compromised application, or physical access. The CVSS vector PR:N indicates no elevated privileges or special permissions are required to trigger the flaw; any local process can potentially reach the vulnerable Bluetooth module interface. The vulnerability is limited to the Bluetooth subsystem, so Bluetooth must be present on the device (standard on all HarmonyOS/EMUI consumer devices). No user interaction is required once malicious code is executing. Exploitation is bounded to local access (AV:L): remote network-based triggering is not possible per the CVSS vector.

The CVSS 3.1 score of 5.1 (Medium) reflects a local-only attack vector with no privilege requirement, no user interaction, and limited dual impact on confidentiality and availability (C:L/I:N/A:L). The local vector (AV:L) significantly constrains the attacker population - only code already executing on the device can trigger this flaw. Despite the PR:N rating, the 'Privilege Escalation' tag creates a tension: if no privileges are needed to begin exploitation, the 'escalation' framing likely refers to bypassing permission gates rather than elevating to a higher OS role. There is no EPSS data or KEV listing provided, and no POC is referenced, placing this firmly in the category of theoretical-to-low real-world risk absent active targeting. SSVC considerations: exploitation is not automated (local access required), technical impact is partial, and Huawei device fleets in enterprise and consumer contexts have no centralized patching mechanism like an enterprise MDM in many deployments. This is a genuine medium-priority finding for Huawei device fleet managers, not an urgent critical response.

A malicious application installed on a Huawei HarmonyOS or EMUI device without Bluetooth-specific permissions invokes an insufficiently guarded Bluetooth system service API, bypassing the expected permission check. The app either reads limited Bluetooth-related data or sends control commands that disrupt the Bluetooth service, degrading connectivity for the device user. No public proof-of-concept code is known at time of analysis, and exploitation requires local code execution on the target device.