EUVD-2026-85810
GHSA-pj37-53vg-9phx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious app on device
-
DeliveryFeed crafted graphics data to graphics module
-
ExploitTrigger out-of-bounds read (CWE-125)
-
ExecutionLeak adjacent memory or crash component
-
ImpactDegrade availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the HarmonyOS device per AV:L - a malicious or compromised application running on the device, or local processing of attacker-crafted graphics content by the graphics module. It cannot be triggered remotely over a network. Impact is bounded to memory disclosure and, primarily, availability degradation (crash) of the graphics component; the vulnerability does not by itself yield code execution or privilege escalation. The requirement for pre-existing local code execution or local input delivery is the main limiting factor on real-world risk. |
| Impact | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 5.9 MEDIUM) describes a locally-exploitable out-of-bounds read (CWE-125) in the HarmonyOS graphics module. The attack vector is LOCAL (AV:L), meaning it cannot be triggered directly over a network - an attacker needs code execution on the device (e.g., a malicious or compromised app) or a locally-processed malicious graphics asset. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active exploitation. The description explicitly states impact is limited to availability, yet the vendor vector also assigns C:L and I:L; this is a mild inconsistency - an OOB read most naturally maps to limited confidentiality (memory disclosure) and availability (crash), with integrity impact being questionable. Overall this is a moderate, defense-in-depth issue rather than an urgent priority: local-only vector plus availability-centric impact keeps real-world risk low-to-moderate despite HarmonyOS's large device footprint. |
| Exploit ScenarioDerived | A malicious application installed on a Huawei HarmonyOS device (phone, wearable, or laptop) feeds crafted graphics data to the vulnerable graphics module, triggering an out-of-bounds read that leaks adjacent memory or crashes the rendering component. Because the attack vector is local (AV:L), the attacker must first run code on the device or induce local processing of a malicious asset; there is no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Out-of-bounds read in the Huawei HarmonyOS graphics module allows an attacker who can already run code locally on the device - or deliver crafted graphics content for local processing - to read past the end of an allocated buffer and crash the graphics component. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) confirms local-only reachability with no privileges or user interaction required, and bounds the impact to limited memory disclosure plus availability degradation; there is no demonstrated path to code execution or privilege escalation. No public exploit code was identified and the CVE is not listed in CISA KEV, so no confirmed active exploitation at time of analysis.
RemediationAI
Patch status: the supplied data does not enumerate a fixed version, so the authoritative source is the Huawei September 2026 consumer security bulletins - apply the software update for the matching device family (phones/general at https://consumer.huawei.com/en/support/bulletin/2026/9/, Vision at https://consumer.huawei.com/en/support/bulletinvision/2026/9/, wearables at https://consumer.huawei.com/en/support/bulletinwearables/2026/9/, laptops at https://consumer.huawei.com/en/support/bulletinlaptops/2026/9/) and confirm the installed build meets or exceeds the version each bulletin lists. Do not install builds named by any other source. Concrete compensating controls, in order of practicality: restrict application installation to the vendor app store or an enterprise allowlist so that a malicious or compromised app cannot reach the graphics module in the first place (trade-off: blocks sideloading and unvetted internal tools, which may break legitimate workflows); in managed fleets, use MDM policy to remove or block untrusted applications and to push updates immediately, accepting the administrative overhead of device re-enrollment and user friction; instruct users to avoid opening untrusted image, video or document files on the device, which reduces the local input-delivery path but cannot be enforced technically and erodes usability for media-heavy roles; where a device is not business-critical, defer handling of untrusted graphics content to a sandboxed or remote rendering service, at the cost of added latency and infrastructure. There is no configuration flag that disables the graphics module, so no pure-configuration workaround exists. For detection, monitor for repeated graphics subsystem crashes or abnormal process restarts near image/media handling, which is the observable symptom of a successful out-of-bounds read; note that memory-disclosure attempts may leave little evidence. No public exploit code was identified at time of analysis, so exploitation attempts are a lower near-term probability, but the controls above remain the only available mitigation until a patched build is confirmed installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-125, out-of-bounds read, in HarmonyOS's graphics subsystem - the stack responsible for image decode, GPU command/buffer handling and display composition. A missing or incorrect bounds check on an index, length or stride derived from attacker-influenced graphics input causes a read past the end of a buffer, which typically yields disclosure of adjacent heap or stack memory and a fault when the access crosses an unmapped page (availability loss). Because the primitive is a read rather than a write (contrast CWE-787/122), the assessment finds no memory-corruption route to code execution, and the vendor's integrity component (I:L) is not reproduced in the independent vector, where I:N. The CPE cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* uses wildcards and therefore does not delimit specific builds, implying the graphics module code is shared across the product line; the four separate Huawei consumer bulletins covering phones, Vision devices, wearables and laptops for September 2026 are consistent with a single shared graphics component being fixed across HarmonyOS device families. Note that third-party tags label the issue "Buffer Overflow" and "Information Disclosure", but the authoritative classification here is an out-of-bounds read confined to the local attack surface.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Local vector (AV:L) via malicious app with no privileges (PR:N); OOB read yields limited memory disclosure (C:L) and crash (A:L) but no genuine integrity impact (I:N).
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
DescriptionCVE.org
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Exploit-DB