EUVD-2026-74595
GHSA-m9gp-rj4w-ffj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall app (no special permissions required)
-
DeliveryInvoke notification module API or IPC channel
-
ExploitPermission gate missing or bypassed (CWE-275)
-
ExecutionNotification service crashes or hangs
-
ImpactDevice notifications unavailable until recovery
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission management
|
| Exploitation Conditions | Exploitation requires code execution on the target HarmonyOS 6.1.0 device; the attack vector is strictly local (AV:L) with no remote exploitation path indicated. The CVSS PR:N metric confirms no elevated privileges are required - any installed application, including those without sensitive platform permissions, may be sufficient to trigger the flaw by interacting with the event notification module. Exploitation is device-version-specific: only HarmonyOS 6.1.0 is confirmed affected. The impact is bounded to the availability of the notification subsystem; confidentiality and integrity of user data are explicitly not at risk per the CVSS vector (C:N/I:N). |
| Impact | The CVSS 6.2 (Medium) score accurately reflects the constrained impact profile: AV:L limits exploitation to code already running on the target device, and the sole impact is availability (A:H). PR:N slightly elevates concern in environments where users install untrusted third-party apps, since no elevated privilege is required to trigger the flaw. The vulnerability does not appear in CISA KEV, and no POC has been identified, so real-world exploitation priority is low. EPSS data was not available in the provided intelligence. The breadth of Huawei's bulletin response - spanning four distinct hardware categories - indicates the event notification module is a shared component across the HarmonyOS ecosystem, widening the population of potentially affected devices, but the availability-only impact caps the severity ceiling. This is a genuine medium-priority patch target for HarmonyOS 6.1.0 fleet operators, not an urgent emergency. |
| Exploit ScenarioDerived | A malicious application installed on a HarmonyOS 6.1.0 device - without requiring any special system permissions - invokes event notification module APIs or sends crafted inter-process events, bypassing the missing permission gate. The notification service crashes or enters an unresponsive state, preventing the device user from receiving system alerts and application notifications until the service recovers or the device is rebooted. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
HarmonyOS 6.1.0's event notification module contains a permission control flaw (CWE-275) that allows a locally-executing process without elevated privileges to disrupt the availability of the notification service. Both the CVSS vector (C:N/I:N/A:H) and Huawei's own bulletin text confirm the impact is strictly an availability denial - confidentiality and integrity are unaffected. Huawei has published remediation across four September 2026 bulletin categories covering consumer devices, smart displays, wearables, and laptops, indicating the flaw spans the full HarmonyOS device ecosystem. No public exploit code has been identified at time of analysis.
RemediationAI
Apply the Huawei September 2026 security update for the relevant device category: consumer devices at https://consumer.huawei.com/en/support/bulletin/2026/9/, Vision smart displays at https://consumer.huawei.com/en/support/bulletinvision/2026/9/, wearables at https://consumer.huawei.com/en/support/bulletinwearables/2026/9/, and laptops at https://consumer.huawei.com/en/support/bulletinlaptops/2026/9/. The exact patched build number is not specified in the available data beyond the bulletin month - consult the individual bulletin page for the specific version string. As a compensating control prior to patching, restricting installation of untrusted third-party applications reduces the local attacker surface, since AV:L exploitation requires a malicious process already running on the device. This control does not eliminate risk from pre-installed or sideloaded apps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HarmonyOS is Huawei's proprietary operating system deployed across smartphones, tablets, wearables (watches/bands), Vision smart displays, and laptops (cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:*). The affected component is the event notification module - the subsystem responsible for routing, queuing, and delivering system and application notifications across the OS. CWE-275 (Permission Issues) identifies the root cause as an improper or absent permission gate on a notification-related API or inter-process communication pathway. The local attack vector (AV:L) combined with no-privilege requirement (PR:N) strongly suggests that a sandboxed application - one holding no special platform permissions - can invoke notification module interfaces in a way the OS does not correctly authorize, triggering a crash or hang in the notification pipeline.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector with no-privilege requirement fits a sandboxed app bypassing a notification permission gate; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
DescriptionCVE.org
Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Exploit-DB