Huawei HarmonyOS EUVD-2026-44665

User interaction is required - the victim must actively open or interact with attacker-controlled content (such as a malicious application, crafted notification, or web page) that invokes the vibration service with pathological input. No authentication or special privileges are required from the attacker's side. Exploitation is limited to Huawei devices running unpatched HarmonyOS or EMUI; the scope does not change (S:U), meaning the DoS is contained to the affected device rather than propagating to adjacent systems. The 'Information Disclosure' tag in source intelligence is inconsistent with the CVSS C:N rating - if confidentiality impact exists, it would represent an additional exploitation condition or impact not currently reflected in the vector.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a moderate-severity DoS: network-reachable, low complexity, no privileges, but requiring user interaction, which meaningfully reduces mass-exploitation feasibility compared to a fully unauthenticated, no-interaction path. EPSS data is not provided; without it, exploitation probability cannot be quantified beyond CVSS signals. The vulnerability is not listed in CISA KEV, and no POC is known at this time, suggesting it has not been weaponized at scale. Notably, the 'Information Disclosure' tag in the source intelligence directly contradicts the CVSS C:N rating - either the tag is misapplied (perhaps carried over from a related advisory) or there is an undisclosed confidentiality dimension not captured in the current CVSS vector; defenders should verify with the Huawei bulletin. Impact is limited to availability (device DoS), with no integrity or confidentiality compromise per the CVSS metrics. Real-world priority is moderate: the user-interaction gate reduces drive-by exploitability, but HarmonyOS and EMUI have a substantial device footprint, particularly in consumer and enterprise Asia-Pacific environments.

An attacker crafts a malicious application or web page that calls the device vibration API with parameters designed to trigger unbounded memory allocation in the vibration service. When a victim on an unpatched HarmonyOS or EMUI device opens the malicious content, the vibration service exhausts device memory, causing the service to crash or rendering the device temporarily unresponsive. No public POC code has been identified, but the low attack complexity rating suggests exploitation would be straightforward once a working trigger is developed.