HarmonyOS EUVD-2026-44655

Local access to the HarmonyOS device is required - this vulnerability cannot be triggered remotely. Any local user account can trigger the flaw (PR:N), meaning no elevated or administrative privileges are needed on the device. The vulnerable code path is the image codec module, so a crafted image file must be delivered to and processed by the device. Conditions that limit exploitation: the attacker must already have local code execution capability or the ability to write a crafted image to a path that the codec processes; the impact is limited to low confidentiality exposure (partial memory read) and low availability disruption (potential service crash), with no integrity impact. The CVSS-assigned UI:N implies the codec can process images without explicit user interaction - for example, via background thumbnail generation - though this is not confirmed independently from the description text.

The CVSS 3.1 base score of 5.1 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L positions this as a medium-severity, locally-exploitable issue. The local attack vector (AV:L) is the primary risk limiter - exploitation requires code execution or file-processing capability on the target device, ruling out remote unauthenticated mass exploitation. EPSS data was not provided in the input; given the local-only vector and limited impact (C:L, A:L), real-world exploitation probability is likely low. This vulnerability is not listed in the CISA KEV catalog, and no POC code has been identified, further supporting a lower operational priority. The PR:N rating (no privileges required) suggests that any local user account can trigger the flaw, which slightly elevates intra-device risk on shared or compromised systems. Overall, this is a genuine but low-urgency vulnerability - the absence of remote exploitability, KEV listing, and POC code means it should be patched on routine cycle rather than emergency response. NOTE: The CVSS-assigned UI:N warrants scrutiny for an image codec flaw, as processing a crafted image typically implies a user opening or sharing the file - defenders should verify whether the codec can be triggered without explicit user action (e.g., via thumbnail generation or background indexing).

A local attacker or malicious application on the HarmonyOS device supplies a specially crafted image file to the image codec module - either directly via a locally-installed app or by placing the file in a directory that triggers automatic processing (e.g., gallery indexing). The codec reads beyond the allocated buffer boundary, leaking a small amount of adjacent memory that may contain sensitive data, or causing the image service to crash. No public exploit code has been identified at time of analysis.