Read the docs
TI-2024-14529 Aliases CVE-2024-21860GHSA-44qh-gw8j-g2gv

Dsoftbus has a use after free vulnerability

Priority MEDIUM 40CWE-416Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

in OpenHarmony v4.0.0 and prior versions allow an adjacent attacker arbitrary code execution in any apps through use after free.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Fixed OpenHarmony (OpenHarmony): v4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenHarmonyOpenHarmonyv3.2.0 – v3.2.4; v4.0.0 to before v4.0.1v4.0.1Patch availableCNA
  • OpenHarmony VendorOpenHarmony Affected v3.2.0 – v3.2.4; v4.0.0 to before v4.0.1 Fixed in v4.0.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:openatom:openharmony:*:*:*:*:-:*:*:*3.2.0 – 3.2.4VulnerableOpenatom
cpe:2.3:o:openatom:openharmony:4.0:*:*:*:-:*:*:*4.0VulnerableOpenatom
  • cpe:2.3:o:openatom:openharmony:*:*:*:*:-:*:*:* Versions 3.2.0 – 3.2.4 Vulnerable ·Openatom
  • cpe:2.3:o:openatom:openharmony:4.0:*:*:*:-:*:*:* Versions 4.0 Vulnerable ·Openatom

Remediation

  • Fix · CNA OpenHarmony (OpenHarmony) Fixed in v4.0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenHarmony v4.0.1

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2024-14523 Dsoftbus has an integer overflow vulnerabilityPriority LOW 33
    • TI-2024-14518 Dsoftbus has an integer overflow vulnerabilityPriority LOW 33
    • TI-2024-14532 Dsoftbus has an improper input validation vulnerabilityPriority LOW 27
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21860
  2. 2026-10-03 Alias added: GHSA-44qh-gw8j-g2gv

References

Advisory 1

  • TI-2024-24711 Arkcompiler Ets Runtime has an out-of-bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-24608 Arkcompiler Ets Runtime has an out-of-bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-24570 Arkcompiler Ets Runtime has a use after free vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-24063 Arkcompiler Ets Runtime has an out-of-bounds read vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-24079 Arkcompiler Ets Runtime has an out-of-bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-22030 web_webview has an out-of-bounds write vulnerability CVSS 3.1HIGH 8.8
See all 176 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences