Huawei HarmonyOS CVE-2026-81647

Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, and the attack can be conducted over a standard network connection with low complexity. This implies the HarmonyOS graphics module is reachable via at least one network-facing pathway (e.g., MMS processing, media thumbnail service, or remote display rendering) without the user actively opening a file. The vulnerability is specific to HarmonyOS 6.1.0; other versions are not confirmed affected. Exploitation is bounded by the A:L impact ceiling - a full system compromise or data exfiltration is not indicated by available data. The UI:N metric should be verified: if the affected code path in practice requires user-initiated file open actions, real-world exploitation complexity is higher than the CVSS vector suggests.

The vendor-supplied CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) classifies this as a medium-severity, network-exploitable denial-of-service issue with low availability impact. The AV:N/PR:N/UI:N combination implies a remotely reachable, unauthenticated attack surface in the graphics module - unusual for a rendering subsystem and worth verifying with Huawei. For a graphics module vulnerability the UI:N metric is notable; if the module is invoked by a network-facing service (e.g., thumbnail rendering, MMS processing), the rating holds, but if it requires a user to open malicious content, UI:R would be more appropriate. EPSS data was not provided, limiting probabilistic exploitation forecasting. No KEV listing and no public POC exist, and the capped A:L impact suggests the DoS effect is partial rather than complete system failure. Overall real-world priority is low-to-medium: the attack is straightforward in theory but the impact ceiling is a module-level crash, and HarmonyOS 6.1.0's global enterprise footprint outside China is limited.

An unauthenticated remote attacker sends crafted network data containing malformed graphics content to a HarmonyOS 6.1.0 device - for example, via an MMS message or a media-rendering API endpoint - triggering an integer overflow in the graphics module that causes an out-of-bounds read and crashes the graphics subsystem. The result is a partial availability disruption (graphics service crash or restart) rather than code execution. No public proof-of-concept has been identified at time of analysis.