Pcmanager EUVD-2026-24065

Exploitation requires local system access (AV:L) and cannot be executed remotely. The attacker must be a local user without administrative privileges (PR:N in CVSS indicates no privilege requirement, but local presence is mandatory). High attack complexity (AC:H) indicates specific conditions must be met-these may include: precise timing windows, particular system configurations, specific PcManager versions, or particular input sequences that trigger the type-confusion flaw. No user interaction is required (UI:N), meaning the attacker can execute the exploit autonomously. The vulnerability does NOT affect confidentiality or integrity, limiting impact to availability disruption. Default or standard PcManager configurations are likely vulnerable, but remote exploitation is impossible; the attacker must already have local shell access or user account on the target system.

This vulnerability presents LOW real-world risk despite privilege-bypass classification. CVSS 3.2 with attack vector local (AV:L) and high complexity (AC:H) substantially limits exploitability compared to network-accessible flaws. EPSS data is unavailable, preventing probabilistic exploitation assessment. KEV status is not indicated, and no public exploit code has been identified, suggesting no active exploitation campaign at analysis time. The scope change (S:C) indicates potential impact beyond the vulnerable component, but availability impact only (A:L, no C/I) means attackers cannot steal data or modify system behavior-only degrade service. The high-complexity requirement (AC:H) is the strongest limiting factor; this is not a trivial privilege escalation. However, any local attacker without initial privileges gaining service-disruption capability warrants patching, particularly if the PcManager utility runs with elevated privileges by default. For enterprise Honor device deployments, validate whether local user access is restricted and whether PcManager is network-exposed indirectly.

A local user without administrative privileges on an Honor device exploits a type-confusion flaw in PcManager's privilege-checking logic by crafting a specific input or triggering a race condition that bypasses authorization checks. This causes PcManager to perform a service-disruptive action (such as terminating critical system processes or corrupting configuration) that an unprivileged user should not be able to trigger, resulting in denial of service to other users or system functions.