Harmonyos EUVD-2026-21842

This vulnerability presents moderate but meaningful risk for HarmonyOS deployments. CVSS 6.3 is elevated by integrity and availability impacts (both High), but substantially mitigated by the privilege requirement-only high-privileged local users (system administrators, privileged services) can trigger the flaw. Attack Vector Local (AV:L) and low complexity (AC:L) mean no network exposure. EPSS data is not provided, but the KEV status is not confirmed as actively exploited. Real-world exploitation is constrained by the need for elevated local access, making this relevant primarily to environments where administrative users may be compromised or untrusted. The combination of information disclosure plus integrity/availability damage (rather than confidentiality alone) increases impact severity; however, the requirement for PR:H significantly narrows the threat actor pool. This is a legitimate priority for patching but not a critical emergency outside high-privilege-user threat models.

A system administrator or high-privilege service account running on a HarmonyOS device exploits the race condition in the power statistics module by sending rapidly successive requests to read and modify power data, winning the synchronization race to leak sensitive power consumption patterns (which may reveal device usage and user behavior) while simultaneously corrupting the statistics database to degrade system availability. The attacker needs only local shell or process-level access at elevated privilege, making this viable if an admin account is compromised or if a malicious privileged app is installed.