What is the CVSS score of EUVD-2026-12341?

EUVD-2026-12341 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Openharmony are affected by EUVD-2026-12341?

CVE-2026-0639 is a low-severity vulnerability in OpenHarmony (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate EUVD-2026-12341?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Openharmony EUVD-2026-12341

| CVE-2026-0639 LOW

Memory Leak (CWE-401)

2026-03-16 OpenHarmony

Information Disclosure Openharmony

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2026-12341

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:08 nvd

LOW 3.3

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.

AnalysisAI

This vulnerability is a memory leak in OpenHarmony v6.0 and prior versions that allows a local, low-privileged attacker to trigger a denial-of-service condition by preventing proper memory release during runtime operations. An authenticated local user without special privileges can exhaust system memory through repeated triggering of the affected code path, causing application or system instability. The low CVSS score of 3.3 reflects the limited scope (local access only, no confidentiality or integrity impact), but the underlying memory management flaw (CWE-401: Missing Release of Memory) is a classic stability threat in systems software.

Technical ContextAI

The vulnerability stems from improper memory management in OpenHarmony's core runtime or kernel subsystem, classified under CWE-401 (Improper Resource Release / Memory Leak). OpenHarmony is an open-source operating system designed for IoT and embedded devices, running on the Huawei HarmonyOS stack. When certain local operations are executed—likely during process or resource cleanup—allocated memory is not properly freed, allowing memory blocks to accumulate over time. The affected product range is OpenHarmony v6.0 and all prior versions (CPE: cpe:2.3:o:huawei:harmonyos or equivalent OpenHarmony CPE). The root cause is likely in a syscall handler, device driver, or process termination routine where cleanup code fails to invoke deallocation functions or handles early returns without cleanup.

RemediationAI

The primary remediation is to upgrade OpenHarmony to a patched version above v6.0 once available from Huawei or the OpenHarmony community. Users should monitor the official OpenHarmony security advisories and Huawei HarmonyOS security bulletins for patch release announcements and apply updates as soon as operationally feasible. Until patches are available, temporary mitigation includes restricting local user access and privileges on affected systems, disabling unnecessary local user accounts, implementing resource quotas (ulimit, cgroups) to limit per-process memory allocation, and isolating multi-tenant or shared systems to prevent untrusted local processes from triggering repeated memory exhaustion. For embedded IoT devices with limited update mechanisms, contact device manufacturers for device-specific patched firmware images.