EUVD-2026-60069
GHSA-cgh6-86mg-ch5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on HarmonyOS 6.1.0 device
-
Deliverycraft malformed image payload
-
Exploitsubmit payload to image codec module
-
Executionnull pointer dereferenced in codec
-
Persistcodec process crashes
-
Impactpartial availability loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the target HarmonyOS 6.1.0 device - for example, a malicious or compromised app running on the device. The CVSS vector specifies AV:L/PR:N, meaning any locally executing process with no elevated privileges can trigger the flaw by passing a crafted image to the codec module. No network access, no authentication, and no user interaction are required beyond the attacker having a process running locally on the device. Exploitation is limited to HarmonyOS 6.1.0 specifically; other OS versions are not confirmed affected. The impact is bounded to partial availability degradation (codec crash, A:L); confidentiality and integrity are not affected. The SSVC assessment that the vulnerability is not automatable further limits mass exploitation scenarios. |
| Impact | The provided CVSS 3.1 base score of 4.0 (Medium) is consistent with the vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - local attack surface, no privileges required, no user interaction, but impact limited to partial availability. SSVC corroborates this low urgency: Exploitation is none, the vulnerability is not automatable, and technical impact is only partial. No EPSS score was provided; given SSVC exploitation=none and no KEV listing, real-world exploitation probability is assessed as low. The combination of a local attack vector and a single-component availability impact (A:L) means this does not enable remote compromise, data theft, or lateral movement. The primary risk is a local denial-of-service against the image rendering pipeline, which would degrade user experience rather than enable a full device takeover. No conflicting signals exist between the available data sources. |
| Exploit ScenarioDerived | A malicious application installed on a HarmonyOS 6.1.0 device supplies a crafted image file to the system's image codec module. The codec fails to validate a pointer before dereferencing it, triggering a null pointer dereference that crashes the codec process and temporarily disrupts image rendering on the device. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
Null pointer dereference in HarmonyOS 6.1.0's image codec module allows a local, unprivileged process to crash the codec and degrade device availability. Huawei disclosed this via their August 2026 security bulletins covering consumer devices, vision products, wearables, and laptops running HarmonyOS. No active exploitation has been identified (SSVC: Exploitation none), and the impact is bounded to partial availability loss with no confidentiality or integrity exposure.
RemediationAI
Apply the patch issued by Huawei in the August 2026 security bulletins. Device owners should update HarmonyOS 6.1.0 to the patched build referenced in the applicable bulletin for their device category (consumer, vision, wearables, or laptops) at https://consumer.huawei.com/en/support/bulletin/2026/8/. An exact patched version number is not independently confirmed beyond the August 2026 bulletin cycle. If immediate patching is not possible, restrict installation of untrusted third-party applications that could supply malformed image inputs to the codec, as this reduces the attack surface for local exploitation. No workaround eliminates the underlying null pointer dereference; patching is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-476 (Null Pointer Dereference) describes a failure to validate that a pointer is non-null before dereferencing it, causing an unhandled exception or process crash. In this case, the vulnerable component is the image codec module within Huawei's HarmonyOS - the operating system powering Huawei consumer devices, wearables, and laptops (CPE: cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*). The codec module is responsible for encoding and decoding image data; a malformed or specially crafted image input can trigger a code path where a null pointer is dereferenced, crashing the process. HarmonyOS 6.1.0 is the confirmed affected version per EUVD-2026-60069. The CVSS local attack vector (AV:L) indicates the trigger occurs within the device's local execution environment rather than over a network interface.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Local vector confirmed; any unprivileged local process can trigger the codec crash with no user interaction, impacting only availability.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
DescriptionCVE.org
Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Exploit-DB