HarmonyOS CVE-2026-58560

Exploitation requires local access to the target HarmonyOS 6.1.0 device - either physical access or a co-located malicious application. Per the CVSS vector (AV:L/PR:N), no elevated privileges are required for a local attacker. The vulnerability is specific to the image codec module, so the codec must be invoked with attacker-influenced image data. The impact is limited to availability (A:L); confidentiality and integrity are not affected. Remote, unauthenticated exploitation is not possible given the local attack vector. Versions of HarmonyOS other than 6.1.0 are not confirmed affected by available data.

The overall real-world risk is low. The CVSS 3.1 base score of 4.0 reflects the limited impact: AV:L constrains exploitation to local access, and the only affected security property is availability at low severity (A:L), with no confidentiality or integrity impact. No EPSS data was provided, and the absence of both KEV listing and public exploit code further reduces urgency. The CVSS vector includes PR:N (no privileges required) combined with AV:L and UI:N, which is an unusual combination for an image codec - typically image parsing is triggered by user interaction - and this inconsistency should be verified against the vendor advisory before making definitive deployment decisions. SSVC signals are weak: exploitation is not confirmed, the attack is not remotely automatable, and technical impact is partial. This vulnerability is best classified as a low-priority patch during normal maintenance cycles rather than an emergency response item.

A local attacker or malicious application on a HarmonyOS 6.1.0 device submits a specially crafted image file to the image codec module, triggering the null pointer dereference and causing the codec process to crash. This results in a denial-of-service condition affecting image rendering or related functionality on the device. No public exploit code is known at time of analysis.