EUVD-2025-208675
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Description
in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios.
Analysis
This vulnerability allows arbitrary code execution in OpenHarmony pre-installed applications through improper handling of incompatible types, enabling local attackers to escalate privileges and execute arbitrary code within the context of trusted system applications. Affected versions include OpenHarmony v5.0.3 through v5.1.0.x, impacting the core application framework across the OpenHarmony ecosystem. While the CVSS score of 6.3 reflects moderate severity, the vulnerability requires local access and high attack complexity, limiting real-world exploitability to restricted scenarios as noted by the vendor.
Technical Context
The vulnerability stems from CWE-843 (Access of Resource Using Incompatible Type), a type confusion or improper type handling defect in OpenHarmony's application runtime environment. Type confusion vulnerabilities in interpreted or dynamically-typed execution contexts (common in mobile OS application frameworks) allow attackers to bypass type safety checks and access memory regions through unintended interfaces, leading to memory corruption and code execution. The affected CPE (cpe:2.3:a:openharmony:openharmony) indicates this impacts the core OpenHarmony platform, which serves as the runtime environment for all pre-installed and third-party applications. The defect likely exists in the application lifecycle management or inter-process communication (IPC) subsystems where type validation occurs during argument marshaling or parameter passing.
Affected Products
OpenHarmony versions v5.0.3 through v5.1.0.x are affected, as confirmed by the ENISA EUVD entry (EUVD-2025-208675) and CPE designation (cpe:2.3:a:openharmony:openharmony:*:*:*:*:*:*:*:*). The vulnerability impacts the core OpenHarmony platform and its pre-installed application suite. Refer to the OpenHarmony security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-11.md for the official vendor advisory and specific patch details.
Remediation
Upgrade to OpenHarmony versions later than v5.1.0.x immediately; consult the OpenHarmony security disclosure (https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-11.md) for the specific patched version number and release timeline. Until patches can be deployed, restrict local access to OpenHarmony devices to trusted users, disable or isolate pre-installed applications that are not essential, and monitor for suspicious inter-process communication patterns via system audit logs. Organizations should prioritize patching systems where users have local shell access or where multiple untrusted local users may coexist.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today