HarmonyOS EUVD-2026-115072

Exploitation requires local access to a HarmonyOS device - per AV:L, the attacker must already be able to run code in a local context (e.g. a malicious or compromised installed application), not reach the device over a network. No authentication or privileges are required (PR:N) and no user interaction is needed (UI:N). The flaw is a permission-control weakness in the graphics module (CWE-264) whose precise triggering interface, configuration, and affected HarmonyOS versions are not described in the available sources. Impact is limited to confidentiality (C:H) with no integrity or availability effect, which bounds realistic risk to information disclosure rather than device takeover; the local-only vector is the primary limiting factor.

This is a moderate-severity local information-disclosure flaw, not a top-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 6.2) describes a local-only attack (AV:L) that requires no privileges or user interaction and yields high confidentiality impact with zero integrity or availability impact. The vuln.today decision label is 'this_month', consistent with a bug that warrants scheduled patching rather than immediate response. No EPSS score, no CISA KEV listing, and no POC reference are present in the input, so exploitation status is 'no public exploit identified at time of analysis'. One signal conflict to note: the Tags list 'Privilege Escalation', but the CVSS and description indicate confidentiality-only impact (C:H/I:N/A:N) via a permission-control weakness (CWE-264), so the real-world effect is unauthorized data/resource access rather than code execution or full privilege elevation - verify the exact mechanism against the Huawei bulletin. The local attack vector and confidentiality-only impact together place this well below the urgency of a remotely exploitable or actively exploited issue.

A malicious or low-trust application already installed on a HarmonyOS device abuses a permission-control weakness in the graphics module to read data it should not be able to access, disclosing sensitive information. Because the CVSS vector is AV:L/PR:N/UI:N, the attacker needs local execution context on the device but no prior privileges and no user interaction. No public exploit code or POC reference was provided in the input.