EUVD-2025-208673
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3Description
in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.
Analysis
OpenHarmony versions 5.0.3 and earlier contain an information disclosure vulnerability caused by use of uninitialized resources, allowing local attackers to leak sensitive case-sensitive data. The vulnerability affects OpenHarmony deployments across all product lines up to v5.0.3.x (per EUVD-2025-208673). An attacker with local access and standard user privileges can read uninitialized memory regions to obtain confidential information without requiring user interaction, though there is no indication of active exploitation in public KEV databases at this time.
Technical Context
The vulnerability is rooted in CWE-908 (Use of Uninitialized Resource), a memory safety issue where uninitialized variables or heap/stack regions retain sensitive data from prior allocations. In the OpenHarmony operating system (as confirmed by CPE cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*), resource initialization routines fail to properly zero or sanitize memory before allocation to user-space processes. This allows local processes to read residual data containing case-sensitive information such as encryption keys, authentication tokens, or other secrets that were previously stored in that memory. The attack requires local code execution capability but no special privileges beyond standard user-level access, making it a practical concern in multi-tenant or shared-device scenarios.
Affected Products
OpenHarmony versions 5.0.3 and all prior releases are affected, as confirmed by EUVD-2025-208673 which lists affected versions as OpenHarmony v5.0.3 and earlier (v5.0.3.x and below). The vulnerability applies to the entire OpenHarmony product line identified by CPE cpe:2.0:a:openharmony:openharmony:*:*:*:*:*:*:*:*. Vendor security disclosures and patch availability details are referenced in the OpenHarmony security repository at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-12.md.
Remediation
Upgrade OpenHarmony to version 5.0.4 or later once released by the vendor; check the official OpenHarmony security advisory at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-12.md for patch availability and timeline. Until patches can be deployed, implement local access controls by restricting shell access and application execution privileges using OpenHarmony's Discretionary Access Control (DAC) or mandatory access control mechanisms, disable inter-process memory sharing where possible, and enforce strong authentication for local system access. For sensitive deployments, consider network isolation of affected systems until patches are confirmed and tested in your environment.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today