Harmonyos EUVD-2026-21879

CVSS 5.1 with local-only attack vector (AV:L) substantially reduces real-world risk compared to network-reachable vulnerabilities. However, multiple risk signals warrant attention: (1) CWE-120 is a fundamental memory safety class with high intrinsic severity; (2) the WEB module is a critical component handling untrusted input daily; (3) CVSS integrity (I:L) and availability (I:L) impacts indicate potential for privilege escalation if chained with other vulnerabilities; (4) local-user exploitation is achievable on any HarmonyOS device where an attacker gains shell access or local execution context. The moderate CVSS reflects attack complexity and scope constraints, not actual exploitability difficulty once access is gained. SSVC assessment: exploitation is not confirmed (no KEV, no POC), technical impact is partial (not full system compromise via single step), and attack is limited to local scope-recommend standard patching cadence rather than emergency response, but prioritize this alongside other local privilege escalation vectors.

A local user with shell access on a HarmonyOS device crafts a malicious HTML file or delivers specially formatted web content that, when processed by the WEB module's parser, triggers an out-of-bounds write. This could overwrite adjacent memory regions (potentially heap or stack), corrupting data structures and causing the application or system service to crash (denial of availability) or leak sensitive information from memory (confidentiality impact). No public exploit code or weaponized in-the-wild samples are documented.