OpenHarmony — recent CVEs

OpenHarmony — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by OpenHarmony (openharmony). https://vulnogram.org/seaview/icons/openharmony.png OpenHarmony — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT CVE-2026-33565 · 3.3 LOW — kernel_linux_common_modules has a Race Condition vulnerability https://vulnogram.org/CVE-2026-33565 https://vulnogram.org/CVE-2026-33565 in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. Low Tue, 19 May 2026 03:08:47 GMT CVE-2026-28733 · 6.5 MEDIUM — filemanagement_storage_service has an use after free vulnerability https://vulnogram.org/CVE-2026-28733 https://vulnogram.org/CVE-2026-28733 in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution. Medium Tue, 19 May 2026 03:08:41 GMT CVE-2026-27766 · 5.5 MEDIUM — multimedia_audio_framework has a Race Condition vulnerability https://vulnogram.org/CVE-2026-27766 https://vulnogram.org/CVE-2026-27766 in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak. Medium Tue, 19 May 2026 03:08:39 GMT CVE-2026-25850 · 5.5 MEDIUM — filemanagement_storage_service has an improper preservation of permissions vulnerability https://vulnogram.org/CVE-2026-25850 https://vulnogram.org/CVE-2026-25850 in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak Medium Tue, 19 May 2026 03:08:35 GMT CVE-2026-25781 · 8.4 HIGH — kernel_liteos_a has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2026-25781 https://vulnogram.org/CVE-2026-25781 in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered. High Tue, 19 May 2026 03:08:30 GMT CVE-2026-28751 · 3.3 LOW — filemanagement_storage_service has an improper input validation vulnerability https://vulnogram.org/CVE-2026-28751 https://vulnogram.org/CVE-2026-28751 in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. Low Tue, 19 May 2026 02:59:07 GMT CVE-2026-27781 · 3.3 LOW — kernel_liteos_a has an integer overflow vulnerability https://vulnogram.org/CVE-2026-27781 https://vulnogram.org/CVE-2026-27781 in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. Low Tue, 19 May 2026 02:59:03 GMT CVE-2026-27648 · 8.8 HIGH — web_webview has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2026-27648 https://vulnogram.org/CVE-2026-27648 in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. High Tue, 19 May 2026 02:58:59 GMT CVE-2026-25110 · 3.3 LOW — Sensors_medical_sensor has a NULL pointer dereference vulnerability https://vulnogram.org/CVE-2026-25110 https://vulnogram.org/CVE-2026-25110 in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. Low Tue, 19 May 2026 02:58:56 GMT CVE-2026-24792 · 8.1 HIGH — web_webview has a Race Condition vulnerability https://vulnogram.org/CVE-2026-24792 https://vulnogram.org/CVE-2026-24792 in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. High Tue, 19 May 2026 02:58:50 GMT CVE-2025-6969 · 5 MEDIUM — ability_ability_runtime an improper input validation vulnerability https://vulnogram.org/CVE-2025-6969 https://vulnogram.org/CVE-2025-6969 in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input. Medium Mon, 16 Mar 2026 07:10:50 GMT CVE-2025-26474 · 3.3 LOW — communication_ipc an improper input validation vulnerability https://vulnogram.org/CVE-2025-26474 https://vulnogram.org/CVE-2025-26474 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios. Low Mon, 16 Mar 2026 07:10:37 GMT CVE-2025-52458 · 5.5 MEDIUM — arkcompiler_ets_runtime has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2025-52458 https://vulnogram.org/CVE-2025-52458 in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios. Medium Mon, 16 Mar 2026 07:10:08 GMT CVE-2025-41432 · 5.5 MEDIUM — arkcompiler_ets_runtime has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2025-41432 https://vulnogram.org/CVE-2025-41432 in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios. Medium Mon, 16 Mar 2026 07:09:53 GMT CVE-2025-25277 · 6.3 MEDIUM — arkcompiler_ets_runtime has a type confusion vulnerability https://vulnogram.org/CVE-2025-25277 https://vulnogram.org/CVE-2025-25277 in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios. Medium Mon, 16 Mar 2026 07:09:27 GMT CVE-2025-12736 · 6.5 MEDIUM — multimedia_audio_standard has an insecure storage of sensitive information vulnerability https://vulnogram.org/CVE-2025-12736 https://vulnogram.org/CVE-2025-12736 in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource. Medium Mon, 16 Mar 2026 07:09:13 GMT CVE-2026-0639 · 3.3 LOW — liteos_a has a missing release of memory vulnerability https://vulnogram.org/CVE-2026-0639 https://vulnogram.org/CVE-2026-0639 in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory. Low Mon, 16 Mar 2026 07:08:53 GMT CVE-2025-27562 · 3.3 LOW — communication_dsoftbus has a missing release of memory vulnerability https://vulnogram.org/CVE-2025-27562 https://vulnogram.org/CVE-2025-27562 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. Low Mon, 11 Aug 2025 02:55:24 GMT CVE-2025-27128 · 8.4 HIGH — liteos_a has an UAF vulnerability https://vulnogram.org/CVE-2025-27128 https://vulnogram.org/CVE-2025-27128 in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free. High Mon, 11 Aug 2025 02:55:20 GMT CVE-2025-25212 · 3.3 LOW — pasteboard has an improper input vulnerability https://vulnogram.org/CVE-2025-25212 https://vulnogram.org/CVE-2025-25212 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input. Low Mon, 11 Aug 2025 02:55:17 GMT CVE-2025-24844 · 3.3 LOW — communication_dsoftbus has a missing release of memory vulnerability https://vulnogram.org/CVE-2025-24844 https://vulnogram.org/CVE-2025-24844 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. Low Mon, 11 Aug 2025 02:55:14 GMT CVE-2025-27536 · 3.3 LOW — arkcompiler_ets_runtime has a type confusion vulnerability https://vulnogram.org/CVE-2025-27536 https://vulnogram.org/CVE-2025-27536 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion. Low Mon, 11 Aug 2025 02:55:12 GMT CVE-2025-26690 · 3.3 LOW — communication dsoftbus has a NULL pointer vulnerability https://vulnogram.org/CVE-2025-26690 https://vulnogram.org/CVE-2025-26690 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Low Mon, 11 Aug 2025 02:55:08 GMT CVE-2025-24925 · 3.3 LOW — applications_settings has a missing release of memory vulnerability https://vulnogram.org/CVE-2025-24925 https://vulnogram.org/CVE-2025-24925 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. Low Mon, 11 Aug 2025 02:55:05 GMT CVE-2025-24298 · 8.4 HIGH — liteos_a has an UAF vulnerability https://vulnogram.org/CVE-2025-24298 https://vulnogram.org/CVE-2025-24298 in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free. High Mon, 11 Aug 2025 02:55:01 GMT CVE-2025-25278 · 8.4 HIGH — liteos_a has a race condition vulnerability https://vulnogram.org/CVE-2025-25278 https://vulnogram.org/CVE-2025-25278 in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition. High Mon, 11 Aug 2025 02:36:43 GMT CVE-2025-27577 · 8.4 HIGH — liteos_a has a race condition vulnerability https://vulnogram.org/CVE-2025-27577 https://vulnogram.org/CVE-2025-27577 in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition. High Mon, 11 Aug 2025 02:36:29 GMT CVE-2025-27247 · 5.5 MEDIUM — Pasteboard has an improper preservation of permissions vulnerability https://vulnogram.org/CVE-2025-27247 https://vulnogram.org/CVE-2025-27247 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. Medium Sun, 08 Jun 2025 11:47:25 GMT CVE-2025-27242 · 3.3 LOW — Ssecurity_component_manager has an improper input vulnerability https://vulnogram.org/CVE-2025-27242 https://vulnogram.org/CVE-2025-27242 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. Low Sun, 08 Jun 2025 11:47:18 GMT CVE-2025-27563 · 3.3 LOW — security_access_token has an improper preservation of permissions vulnerability https://vulnogram.org/CVE-2025-27563 https://vulnogram.org/CVE-2025-27563 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. Low Sun, 08 Jun 2025 11:47:13 GMT CVE-2025-26693 · 3.3 LOW — security_access_token has an improper preservation of permissions vulnerability https://vulnogram.org/CVE-2025-26693 https://vulnogram.org/CVE-2025-26693 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. Low Sun, 08 Jun 2025 11:47:09 GMT CVE-2025-26691 · 5.5 MEDIUM — telephony_call_manager has an improper preservation of permissions vulnerability https://vulnogram.org/CVE-2025-26691 https://vulnogram.org/CVE-2025-26691 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. Medium Sun, 08 Jun 2025 11:47:04 GMT CVE-2025-27131 · 6.1 MEDIUM — kernel_liteos_m has an improper input vulnerability https://vulnogram.org/CVE-2025-27131 https://vulnogram.org/CVE-2025-27131 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. Medium Sun, 08 Jun 2025 11:46:58 GMT CVE-2025-24493 · 5.5 MEDIUM — kernel_liteos_a has a race condition vulnerability https://vulnogram.org/CVE-2025-24493 https://vulnogram.org/CVE-2025-24493 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition. Medium Sun, 08 Jun 2025 11:46:53 GMT CVE-2025-25217 · 3.3 LOW — arkui_ace_enginehas a NULL pointer dereference vulnerability https://vulnogram.org/CVE-2025-25217 https://vulnogram.org/CVE-2025-25217 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Low Sun, 08 Jun 2025 11:46:49 GMT CVE-2025-23235 · 3.3 LOW — arkcompiler_ets_runtime has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2025-23235 https://vulnogram.org/CVE-2025-23235 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read. Low Sun, 08 Jun 2025 11:46:40 GMT CVE-2025-21082 · 3.3 LOW — arkui_ace_engine has a type confusion vulnerability https://vulnogram.org/CVE-2025-21082 https://vulnogram.org/CVE-2025-21082 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion. Low Sun, 08 Jun 2025 11:46:32 GMT CVE-2025-20063 · 3.3 LOW — arkui_ace_engine has a type confusion vulnerability https://vulnogram.org/CVE-2025-20063 https://vulnogram.org/CVE-2025-20063 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion. Low Sun, 08 Jun 2025 11:46:20 GMT CVE-2025-25052 · 3.3 LOW — arkcompiler_ets_runtime has a buffer overflow vulnerability https://vulnogram.org/CVE-2025-25052 https://vulnogram.org/CVE-2025-25052 in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow. Low Tue, 06 May 2025 09:03:38 GMT CVE-2025-27241 · 3.3 LOW — multimedia_av_codec has a NULL pointer dereference vulnerability https://vulnogram.org/CVE-2025-27241 https://vulnogram.org/CVE-2025-27241 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Low Tue, 06 May 2025 09:03:33 GMT CVE-2025-27248 · 3.3 LOW — ai_neural_network_runtime has a NULL pointer dereference vulnerability https://vulnogram.org/CVE-2025-27248 https://vulnogram.org/CVE-2025-27248 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Low Tue, 06 May 2025 09:03:26 GMT CVE-2025-22886 · 3.3 LOW — distributeddatamgr_udmf has a memory leak vulnerability https://vulnogram.org/CVE-2025-22886 https://vulnogram.org/CVE-2025-22886 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. Low Tue, 06 May 2025 09:03:16 GMT CVE-2025-27132 · 3.8 LOW — arkcompiler_ets_runtime has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2025-27132 https://vulnogram.org/CVE-2025-27132 in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios. Low Tue, 06 May 2025 09:03:12 GMT CVE-2025-25218 · 3.3 LOW — third_party_mksh has a NULL pointer dereference vulnerability https://vulnogram.org/CVE-2025-25218 https://vulnogram.org/CVE-2025-25218 in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Low Tue, 06 May 2025 08:50:02 GMT CVE-2025-27534 · 3.3 LOW — arkcompiler_ets_runtime has an out-of-bounds read vulnerability https://vulnogram.org/CVE-2025-27534 https://vulnogram.org/CVE-2025-27534 in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory. Low Mon, 07 Apr 2025 02:35:54 GMT CVE-2025-25057 · 3.3 LOW — third_party_NuttX has a memory leak vulnerability https://vulnogram.org/CVE-2025-25057 https://vulnogram.org/CVE-2025-25057 in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory. Low Mon, 07 Apr 2025 02:35:48 GMT CVE-2025-24304 · 3.3 LOW — arkcompiler_ets_runtime has an out-of-bounds write vulnerability https://vulnogram.org/CVE-2025-24304 https://vulnogram.org/CVE-2025-24304 in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds write. Low Mon, 07 Apr 2025 02:35:43 GMT CVE-2025-22851 · 6.5 MEDIUM — Liteos_A has an integer overflow vulnerability https://vulnogram.org/CVE-2025-22851 https://vulnogram.org/CVE-2025-22851 in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. Medium Mon, 07 Apr 2025 02:35:39 GMT CVE-2025-22842 · 3.3 LOW — arkcompiler_ets_runtime has an out-of-bounds read vulnerability https://vulnogram.org/CVE-2025-22842 https://vulnogram.org/CVE-2025-22842 in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Low Mon, 07 Apr 2025 02:35:35 GMT CVE-2025-22452 · 3.3 LOW — arkcompiler_ets_runtime has an out-of-bounds read vulnerability https://vulnogram.org/CVE-2025-22452 https://vulnogram.org/CVE-2025-22452 in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Low Mon, 07 Apr 2025 02:35:30 GMT