Huawei HarmonyOS EUVD-2026-115081

Exploitation requires LOCAL access to the HarmonyOS device - the attacker must be able to run code or an application on the device (AV:L), for example via a malicious or compromised app; it cannot be triggered remotely over the network. No authentication or elevated privileges are needed (PR:N) and no user interaction is required (UI:N) once local access exists. The limiting factor is the local-access precondition itself, which is the primary barrier to exploitation. The exact peripheral-module feature, API, or configuration that must be exercised is not described in the available sources beyond its identification as the 'peripheral module'.

This is a moderate-severity local information-disclosure flaw, not a high-urgency priority. The CVSS 3.1 base score is 5.9 with vector AV:L/AC:L/PR:N/UI:N - the attack vector is LOCAL, meaning an attacker must already be able to run code or interact with the device locally (e.g., a malicious or compromised app) rather than reach it over the network. Despite PR:N (no privileges required) and AC:L (low complexity), the local vector sharply limits real-world exploitability compared to a remote bug. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public exploit was supplied in the input, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_month', consistent with a bug worth patching in the normal cycle rather than an emergency. One inconsistency to note: the supplied CVSS vector claims C:L/I:L/A:L (confidentiality, integrity AND availability impact), but the Impact text states only 'may affect service confidentiality' - an out-of-bounds READ (CWE-805) typically yields disclosure only, so the integrity/availability impact in the vendor vector is not supported by the description and should be verified with Huawei.

A malicious or compromised application running locally on a HarmonyOS device invokes the affected peripheral module with crafted input, triggering an out-of-bounds read that returns adjacent memory contents to the attacker. Because the vector is local (AV:L), the attacker needs prior code execution or app-level access on the device; the disclosed memory could leak sensitive data from the peripheral service's address space. No public exploit code was identified in the provided intelligence.