What is the CVSS score of CVE-2026-58559?

CVE-2026-58559 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Huawei HarmonyOS CVE-2026-58559

EUVD-2026-44665 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-07-15 huawei

GHSA-c38h-7xm3-hv7v

Information Disclosure Harmony Os Emui

6.5

CVSS 3.1 · Vendor: huawei

Severity by source

Vendor (huawei) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

User interaction required to trigger vibration service; no privileges needed; only availability impacted with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (huawei).

CVSS VectorVendor: huawei

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 13:20 vuln.today

DescriptionCVE.org

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

Uncontrolled memory allocation in Huawei's vibration service crashes affected HarmonyOS and EMUI devices, resulting in a denial-of-service condition impacting device availability. The flaw is remotely triggerable with no privileges required but demands user interaction, consistent with delivery via crafted content such as a malicious application, webpage, or message that exercises the vibration API. No public exploit code or active exploitation has been identified at time of analysis, though Huawei has issued a July 2026 security bulletin addressing the issue.

Technical ContextAI

CWE-789 (Uncontrolled Memory Allocation) identifies the root cause: the vibration service fails to impose an upper bound on memory it allocates in response to crafted input, allowing an attacker-controlled call to exhaust available resources and crash the service or the device. The affected products, per CPE strings cpe:2.3:a:huawei:harmony_os:*:*:*:*:*:*:*:* and cpe:2.3:a:huawei:emui:*:*:*:*:*:*:*:*, span all currently listed versions of both HarmonyOS (Huawei's proprietary OS) and EMUI (its Android-derived layer), indicating a shared or ported vibration service component. The wildcard version qualifiers mean precise affected build ranges are not enumerated in NVD CPE data and must be confirmed via the vendor bulletin.

RemediationAI

Apply the patch issued by Huawei in the July 2026 security bulletin (https://consumer.huawei.com/en/support/bulletin/2026/7/); the exact patched version numbers are not enumerated in available NVD data and must be confirmed from that advisory. Users should update HarmonyOS and EMUI devices to the build version specified by Huawei as the remediated release via the device's OTA update mechanism (Settings > System > Software update). As a compensating control prior to patching, restricting installation of untrusted third-party applications that invoke vibration APIs can reduce the attack surface, though this does not address web- or message-delivered vectors. Disabling vibration system-wide via accessibility settings would eliminate the vulnerable code path but significantly degrades usability for notification-dependent workflows.