Harmonyos EUVD-2026-21796

CVSS 6.1 is moderate but somewhat inflated by availability impact scoring; real-world risk is constrained by multiple factors. Attack Vector:Local and Privileges Required:Low significantly limit exploitation scope compared to network-based attacks-attacker must have local shell access or social engineering capability. User Interaction:Required (UI:R) adds friction, requiring user engagement with malicious media. However, Scope:Unchanged means impact is limited to the vulnerable component itself. Availability impact rated High, but actual DoS effect is localized to the media application rather than system-wide. No EPSS score, KEV status, or public exploit code provided-absence of these signals suggests this is not currently a priority threat despite the CVE number. The vulnerability should be patched as part of normal update cycles but does not warrant emergency response absent additional context of active exploitation.

An authenticated local user with access to an HarmonyOS device crafts or obtains a malicious media file (image, video, or audio) designed to trigger deep recursion in the media platform parser. The user either opens the file directly through a media application or tricks another user into opening it. The parser encounters the malicious media structure, enters an unbounded loop, exhausts stack memory, and crashes the media application or system process, rendering media functionality unavailable until reboot. Complexity is low due to straightforward media file construction and user interaction requirement.