What is the CVSS score of EUVD-2026-35363?

EUVD-2026-35363 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

HarmonyOS EMUI EUVD-2026-35363

| CVE-2026-41977 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-06-09 huawei

GHSA-988p-jh3p-gxwh

Information Disclosure Integer Overflow Emui

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 08:04 vuln.today

DescriptionCVE.org

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability.

AnalysisAI

Integer overflow in the HarmonyOS and EMUI log service enables a local attacker, without requiring system privileges, to cause a denial-of-service condition and limited integrity impact on affected Huawei devices. The vulnerability is rooted in CWE-190 (Integer Overflow or Wraparound) within the log service component, with the CVSS-defined changed scope indicating the fault can affect components beyond the log service itself. No public exploit code and no confirmed active exploitation have been identified at time of analysis.

Technical ContextAI

The affected components are Huawei HarmonyOS and EMUI, Huawei's mobile operating system and Android-based skin respectively, as confirmed by CPE strings cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* and cpe:2.3:a:huawei:emui:*:*:*:*:*:*:*:*. The root cause is CWE-190 (Integer Overflow or Wraparound): when the log service processes arithmetic on integer values without adequate bounds checking, a wraparound can corrupt internal state or resource counters, leading to service disruption. The CVSS Scope:Changed designation indicates that the faulty log service component can impact the security posture of other components on the device beyond the log subsystem itself. A note on data consistency: the CVE tags include 'Information Disclosure' yet the CVSS vector specifies C:N (no confidentiality impact); this discrepancy is unresolved from available data and may indicate a tagging error or an undocumented secondary effect.

RemediationAI

Consult the Huawei June 2026 security bulletins at https://consumer.huawei.com/en/support/bulletin/2026/6/ and https://consumer.huawei.com/en/support/bulletinvision/2026/6/ for patch details and exact fixed versions; no specific patched version number was independently confirmed from the available data (patch available per vendor advisory). Users should apply any OTA system update issued by Huawei for their HarmonyOS or EMUI device. As a compensating control where patching is delayed, restricting untrusted application installation and limiting physical or logical device access reduces the attacker's ability to reach the local attack vector and trigger the required user interaction. Disabling or sandboxing third-party log-consuming applications may limit exposure, though this could affect system observability.