HarmonyOS CVE-2026-81646

Exploitation requires local code execution on a HarmonyOS 6.1.0 device - an attacker or malicious application must already be running on the target device. The CVSS PR:N metric indicates no elevated OS privileges are required; any local process capable of invoking the graphics module API is sufficient. The vulnerability is constrained to HarmonyOS 6.1.0 across consumer, wearable, and laptop form factors. No network-reachable interface, no user interaction beyond running the malicious app, and no special configuration are required. The local-only attack vector (AV:L) is the primary limiting factor, making remote exploitation directly infeasible.

The local attack vector (AV:L) significantly limits the threat surface - exploitation requires code execution on the target device, which substantially reduces opportunistic attack scenarios. The CVSS score of 5.9 (Medium) reflects moderate but bounded impact across confidentiality, integrity, and availability, all rated Low. Even a mid-sized municipal IT team in walbrzych deploying Huawei HarmonyOS endpoints should treat this as a routine patch-cycle priority rather than an emergency, given the absence of KEV listing, no confirmed public exploit, and the local-only attack surface. The vendor's own impact statement emphasizes availability, though the CVSS vector also records C:L and I:L - partial memory leakage is consistent with an out-of-bounds read, but the I:L (integrity) rating is difficult to justify for a read-only memory access primitive and may be conservatively overstated. EPSS data is not provided, and no active exploitation has been reported. The multiple bulletin categories (consumer, wearables, laptops) indicate broad surface area within the HarmonyOS ecosystem but do not elevate urgency absent exploitation signals.

A malicious application installed on a HarmonyOS 6.1.0 device invokes graphics rendering functions with crafted input parameters that cause the graphics module to read beyond its allocated buffer. This results in a partial crash or performance degradation of the graphics subsystem, and adjacent memory contents may be partially leaked to the calling process. No public proof-of-concept exploit code has been identified at time of analysis.