Huawei HarmonyOS EUVD-2026-115074

Exploitation requires local access to the device (AV:L) and mandatory user interaction (UI:R) - e.g. the victim installing or running attacker-supplied code - targeting the permission-control logic of the HarmonyOS background task management module. The scope change (S:C) indicates the flaw lets an actor affect resources beyond the vulnerable component's authorization scope, but impact is confined to limited confidentiality (C:L) with no integrity or availability effect per the vector. Limiting factors: no remote network vector, the requirement for user interaction, and the need for local code execution context substantially constrain realistic exploitation. The exact feature/configuration that triggers the flaw is not described in the available sources.

This is a low-severity issue (CVSS 3.1 base 3.6) and the aggregated signals agree it is not a priority. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N indicates a local attack vector (AV:L) requiring user interaction (UI:R), with low attack complexity and no prior privileges, yielding only a limited confidentiality impact (C:L) and no integrity or availability impact despite a scope change (S:C). The vuln.today decision label is 'monitor', the weakest urgency tier, and this is consistent with the low score. No EPSS probability, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One conflict must be flagged: the Impact text states exploitation 'may affect service integrity', yet the CVSS vector sets I:N and scores only C:L - this integrity/confidentiality mismatch should be verified against the Huawei bulletin, as the mechanism is not described. Net: a real but minor hardening issue requiring local access and user interaction, not an emergency.

A user is induced to install or run a malicious local application on a HarmonyOS device; the app abuses a permission-control weakness in the background task management module to read limited information it should not have access to, crossing a trust boundary (scope change). No public exploit code is identified, and the exact trigger is not described in the available sources.