Huawei HarmonyOS EUVD-2026-115076

Exploitation requires a victim running HarmonyOS to open or preview an attacker-supplied, specially crafted file within the file preview module - the preview action is the explicit trigger (reflected by UI:R). No authentication is required against the target (PR:N), so no prior account or privilege on the device is needed, but the mandatory user interaction (the victim must actively preview the malicious file) is the primary limiting factor and prevents unattended, wormable exploitation. The specific file format(s) and preview configuration that trigger the overflow are not described in the available sources.

This is a moderate-severity (CVSS 4.7) buffer overflow in the HarmonyOS file preview module whose only stated impact is availability. The signals point to a genuinely low-urgency issue rather than a top priority: no EPSS score is provided, the vulnerability is NOT in CISA KEV (confirmed: no public exploit identified at time of analysis), and no PoC reference appears in the input. The vendor-adjacent priority signal (vuln.today Decision label: this_month) aligns with patch-in-routine-cycle urgency, not emergency. There is an internal CONFLICT in the supplied data that must be verified with Huawei: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) encodes a confidentiality-only impact with changed scope and NO availability impact, whereas the Impact text states exploitation 'may affect availability' (A should be non-None). These two cannot both be literally true, so the authoritative impact dimension is ambiguous. Even taking the worse of the two readings, exploitation requires user interaction (UI:R - a victim must preview a malicious file), which meaningfully limits mass exploitation. Net: a real but routine patch-cycle item, not a drop-everything emergency.

An attacker delivers a specially crafted file (e.g., via messaging, email, or a shared link) to a HarmonyOS user and induces them to open it in the file preview module, where parsing the malformed file triggers the buffer overflow. Because the overflow is in a preview/parser path and the stated impact is availability, the realistic outcome is a crash or denial of service of the affected component rather than confirmed code execution. No public exploit code or PoC reference is present in the available data.