Huawei HarmonyOS EUVD-2026-115073

Exploitation requires getting a crafted/malformed file processed by the HarmonyOS file parsing module, and the attack vector is local (AV:L), so the attacker needs local access or a means to have the file parsed on the target device rather than a remote network path. The specific file format, protocol, or configuration that triggers the fault is not described in the available sources. Limiting factors that reduce real-world risk: local-only reach (no remote exploitation), availability-only impact rated low (A:L, not full A:H), and no confidentiality or integrity consequence; authentication is not required per PR:N, but local delivery is the gating prerequisite.

This is a low-to-moderate priority issue rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) describes a locally-exploitable, low-complexity flaw with no privilege requirement, but the only consequence is partial availability loss (A:L) - no confidentiality or integrity impact - yielding a base score of 4.0 (Medium). Signals are consistent and point to limited real-world urgency: there is no CISA KEV listing, no POC or exploit reference in the input, and no EPSS probability was supplied, so there is no evidence of active or likely exploitation. The vuln.today decision label is 'this_month', which aligns with the modest severity and the absence of exploitation signals - not with act_now/emergency. The chief caveat is a metadata conflict: the input Tags label this 'Information Disclosure', yet the CVSS vector and vendor impact statement are availability-only (C:N/I:N/A:L), so the 'Information Disclosure' characterization appears incorrect and should be disregarded in favor of the DoS/availability framing.

An attacker able to deliver a specially crafted file to the HarmonyOS file parsing module on a device they can reach locally triggers a parsing fault that degrades or interrupts the affected service's availability. Because the vector is local (AV:L), the attacker needs local access or a way to get the malformed file processed on the device rather than a purely remote network path. No public exploit identified at time of analysis.