Huawei HarmonyOS EUVD-2026-115083

Exploitation targets the event notification management module of Huawei HarmonyOS and EMUI, abusing insufficient permission enforcement (CWE-264). Per the CVSS vector, user interaction is required (UI:R) and attack complexity is high (AC:H), both of which limit exploitation: an attacker must get the victim to perform some action and must satisfy conditions that are not fully attacker-controlled. The affected component is an on-device OS module, so a local foothold such as an installed app is the realistic prerequisite despite the input's AV:N marking. The specific trigger and the exact configuration/versions affected are not described in the available sources (the references are bulletin index pages without per-CVE detail), so the precise feature state required cannot be confirmed from the provided data.

This is a moderate-priority issue rather than an emergency. The vuln.today decision label is 'this_week', consistent with a serious-but-not-critical defect. No CISA KEV listing, no EPSS score, and no PoC or exploit reference are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or available weaponized code. The input CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H, 7.1) carries two notable internal tensions that should be verified with the vendor: (1) the stated Impact text says the flaw 'may affect service confidentiality' only, yet the vector asserts I:H and A:H - the integrity/availability impacts are not supported by the supplied description and may be overstated; and (2) the vector marks AV:N (network) while the affected products are the HarmonyOS/EMUI mobile operating systems and the flaw is a permission-control defect in a local 'event notification management module', which typically implies a local/on-device attacker (e.g., a malicious installed app) rather than a remote network path. AC:H and UI:R both raise the exploitation bar - high attack complexity plus required user interaction materially reduce real-world exploitability. Net: a genuine permission-control weakness worth patching on a normal cycle, but the raw 7.1 likely overstates practical risk given the confidentiality-only impact actually described and the complexity/interaction constraints.

A malicious or privilege-limited app on a Huawei device abuses weak permission checks in the event notification management module to read notification-related data it should not be able to access, disclosing sensitive information from other apps or the system. Because the vector requires user interaction and high attack complexity, success depends on tricking the user into a specific action and on conditions the attacker does not fully control. No public exploit or PoC is identified in the available data.