EUVD-2026-74599
GHSA-p4hv-25pv-2j2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious preview-triggering file
-
DeliveryDeliver file/link to HarmonyOS 6.1.0 user
-
ExploitUser opens or previews content
-
ExecutionPreview service module crashes
-
ImpactAvailability of preview service lost
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission and access control
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the targeted user actively opens or previews a crafted file or content item, making user interaction the primary limiting factor (CVSS UI:R). The vulnerability is specific to HarmonyOS 6.1.0; other HarmonyOS versions are not confirmed affected. No authentication is required from the attacker's side (PR:N), but the attacker must deliver a malicious file or link to the victim. The attack surface is the preview service module, which must be reachable - meaning the user's device must process the attacker-supplied content. The impact is strictly availability of the preview service (A:L); there is no path to data disclosure or system compromise under the described conditions. |
| Impact | The CVSS 4.3 score reflects a genuinely low-to-moderate risk: the attack is network-reachable (AV:N) and requires no privileges (PR:N), but user interaction (UI:R) is a meaningful barrier, and the impact is limited to a low availability hit (A:L) with no confidentiality or integrity loss. EPSS data is not provided, and the vulnerability is not listed in CISA KEV, nor is any public exploit code available, all of which further reduce urgency. The S:U scope indicates no lateral movement or secondary system compromise. Even a mid-sized municipal IT team in malbork managing Huawei device fleets should note that this does not represent an active threat to data or system integrity - only service interruption in the preview subsystem. The mislabeled 'Privilege Escalation' tag in the source metadata is inconsistent with the described impact and CVSS metrics; real-world triage should discount that tag entirely. |
| Exploit ScenarioDerived | An attacker hosts a crafted file (such as a document or media asset) and induces a HarmonyOS 6.1.0 user to open or preview it - via a phishing link or malicious attachment. When the preview service processes the file, the access-control flaw is triggered, crashing or hanging the preview module and denying the user that service. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Denial-of-service in the HarmonyOS preview service module allows a remote, unauthenticated attacker to degrade or crash the preview functionality when a user interacts with a crafted input. Affected versions are limited to HarmonyOS 6.1.0 on Huawei consumer devices. Exploitation yields only a low-severity availability impact; confidentiality and integrity are unaffected.
RemediationAI
Apply the Huawei-issued security patch described in the September 2026 consumer bulletin at https://consumer.huawei.com/en/support/bulletin/2026/9/ and the laptop bulletin at https://consumer.huawei.com/en/support/bulletinlaptops/2026/9/. The exact patched HarmonyOS build version is not independently confirmed from the available references - consult the bulletin for the precise update version. As a compensating control prior to patching, administrators or MDM operators managing Huawei device fleets may consider restricting third-party file preview access by disabling untrusted content sources, thereby reducing the attack surface for UI:R-dependent exploitation. No workaround eliminates the underlying flaw; patching remains the only confirmed remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in HarmonyOS's preview service module - a system-level component responsible for rendering file and content previews. The root-cause CWE-264 (Permissions, Privileges, and Access Controls) suggests the preview service may fail to enforce access controls or resource limits, enabling a denial-of-service condition when processing maliciously structured preview requests. The affected product is identified by CPE cpe:2.3:a:huawei:harmonyos:*:*:*:*:*:*:*:* with version 6.1.0 confirmed in EUVD-2026-74599. The CVSS vector (UI:R) indicates user interaction - likely opening or previewing a crafted document or media file - is required to trigger the fault.
Know when Harmonyos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network-reachable service, no auth required, but user must interact to trigger; impact is availability-only and low.
Primary rating from Vendor (huawei).
CVSS VectorVendor: huawei
DescriptionCVE.org
DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Out-of-bounds heap write in Huawei HarmonyOS WEB module allows unauthenticated remote attackers to execute arbitrary cod
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Exploit-DB