Huawei HarmonyOS EUVD-2026-115080

Requires local access to the device: an attacker-controlled or compromised process/app running on HarmonyOS that can reach the location service module to trigger the use-after-free (AV:L). No authentication and no user interaction are needed (PR:N/UI:N) and attack complexity is low (AC:L), so once code is executing locally the trigger is not gated by special configuration - but the input does not describe the exact call sequence or state that frees-then-reuses the object, so the precise trigger is not described in the available sources. The principal limiting factor is the local attack vector: remote, network-based exploitation is not supported by the vector, which substantially narrows realistic risk to scenarios where a hostile app is already installed.

This is a moderate-severity, low-urgency issue by the available signals, not a drop-everything priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 5.9) describes a locally-triggered use-after-free with low attack complexity and no privileges required, but with only Low impact to each of confidentiality, integrity and availability and no scope change. The vuln.today decision label is 'this_month', which is consistent with a non-emergency but patch-worthy finding. There is no KEV listing, no EPSS score, and no PoC or exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis' and exploitation is neither confirmed nor demonstrated. Two internal conflicts should be verified rather than treated as fact: (1) the free-text Impact says the flaw 'may affect availability' only, yet the CVSS vector assigns Low to confidentiality and integrity as well and the input Tags include 'Information Disclosure' and 'Memory Corruption' - the actual impact surface is therefore ambiguous between a denial-of-service crash and a limited info-leak; and (2) AV:L means the attacker needs local access (e.g. a malicious or compromised app on the device), which materially limits real-world reach despite PR:N. Net: a genuine memory-safety bug worth patching on the vendor's normal cadence, not evidence of a widespread or actively exploited threat.

A malicious or compromised application already present on a HarmonyOS device interacts with the location service module to trigger the use-after-free, with low complexity and without needing elevated privileges or user interaction (AV:L/AC:L/PR:N/UI:N). The most consistent outcome with the stated impact is a crash or disruption of the service (availability), though the memory-corruption/info-disclosure tags leave a limited information leak as an unverified possibility. No public exploit code or PoC reference is present in the input.