HarmonyOS EUVD-2026-35365

Exploitation requires a low-privilege authenticated principal on the HarmonyOS device (PR:L per CVSS vector) - unauthenticated remote exploitation is not supported by the available data. The race condition mechanism (AC:H) demands that the attacker trigger concurrent IPC operations and win a timing window, meaning exploitation is non-deterministic and requires either repeated attempts or knowledge of favorable system load conditions. The IPC module must be reachable by the attacker's process context, implying the attacker has either local code execution at low privilege or network-level ability to interact with the IPC interface. Exploitation is scoped to the unchanged boundary (S:U), so lateral movement beyond the compromised component is not indicated by the CVSS data. Limiting factors: authentication barrier (PR:L), non-trivial race condition timing (AC:H), and the requirement for network or local access to the IPC module - not a default-open, zero-click condition.

The CVSS base score of 6.4 (Medium) reflects a genuinely mixed risk picture. The network attack vector (AV:N) is the most concerning element, but high attack complexity (AC:H) is a significant mitigating factor - winning a race condition requires repeated attempts or favorable system scheduling, limiting reliable automated exploitation. Low privileges required (PR:L) means unauthenticated exploitation is ruled out by the CVSS vector. The primary real-world risk is information disclosure (C:H), with only minor integrity (I:L) and availability (A:L) impact - notably, the vendor description emphasizes availability impact, which conflicts with the CVSS vector that rates confidentiality as the dominant concern; this discrepancy should be verified against the Huawei bulletin. No EPSS score was provided, preventing probabilistic exploitation likelihood assessment. There is no CISA KEV listing and no known public exploit, suggesting this has not been weaponized at scale. Overall, this is a real but targeted-risk issue: well-positioned, authenticated attackers on affected devices face a plausible but technically demanding exploitation path, not a trivial mass-exploitation scenario.

An attacker authenticated with a low-privilege account (e.g., a malicious application or a compromised service account on the device) sends a rapid sequence of concurrent IPC requests to the vulnerable module, triggering a timing window where a memory object is freed while a second thread still holds a reference. By influencing memory allocation to reclaim the freed region with attacker-controlled data, the attacker dereferences the stale pointer and reads sensitive cross-process memory contents. No public exploit code has been identified, and the race condition (AC:H) means this attack requires multiple attempts and is not trivially scripted into a one-shot reliable exploit.