Vulnerabilities

TI-2025-06337 CVE-2025-6969 · GHSA-56j9-gv37-wm36

ability_ability_runtime an improper input validation vulnerability

LOW 24

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00154 Published 2026-03-16 No fix listed CWE-20

TI-2025-19421 CVE-2025-26474 · GHSA-vr6x-jjgx-5wwg

communication_ipc an improper input validation vulnerability

LOW 15

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00143 Published 2026-03-16 No fix listed CWE-20

TI-2025-32586 CVE-2025-52458 · GHSA-v8r2-jx92-x3gr

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

LOW 33

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00167 Published 2026-03-16 No fix listed CWE-787

TI-2025-27596 CVE-2025-41432 · GHSA-q3qm-rvx8-4rrq

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

LOW 33

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00179 Published 2026-03-16 No fix listed CWE-787

TI-2025-18931 CVE-2025-25277 · GHSA-9jcr-498r-jxxc

arkcompiler_ets_runtime has a type confusion vulnerability

LOW 32

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00157 Published 2026-03-16 No fix listed CWE-843

TI-2025-11672 CVE-2025-12736 · GHSA-2c6c-mrq5-cw27

multimedia_audio_standard has an insecure storage of sensitive information vulnerability

LOW 28

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00174 Published 2026-03-16 No fix listed CWE-908

TI-2026-00436 CVE-2026-0639 · GHSA-7wx7-hcfj-9cvg

liteos_a has a missing release of memory vulnerability

LOW 24

in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00161 Published 2026-03-16 No fix listed CWE-401

TI-2025-20381 CVE-2025-27562 · GHSA-m2mf-qqpm-8vch

communication_dsoftbus has a missing release of memory vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-401

TI-2025-19985 CVE-2025-27128 · GHSA-xc48-fv99-qvrm

liteos_a has an UAF vulnerability

LOW 38

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00159 Published 2025-08-11 No fix listed CWE-416

TI-2025-18881 CVE-2025-25212 · GHSA-qg6v-4fp5-q658

pasteboard has an improper input vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-20

TI-2025-18553 CVE-2025-24844 · GHSA-7427-8ggf-g35c

communication_dsoftbus has a missing release of memory vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-401

TI-2025-20365 CVE-2025-27536 · GHSA-r4pq-968w-g9qp

arkcompiler_ets_runtime has a type confusion vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-843

TI-2025-19624 CVE-2025-26690 · GHSA-q7f5-h647-x236

communication dsoftbus has a NULL pointer vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-476

TI-2025-18626 CVE-2025-24925 · GHSA-5mrq-2j6g-h4pf

applications_settings has a missing release of memory vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-401

TI-2025-18044 CVE-2025-24298 · GHSA-xwf4-4p9v-22fp

liteos_a has an UAF vulnerability

LOW 38

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00159 Published 2025-08-11 No fix listed CWE-416

TI-2025-18932 CVE-2025-25278 · GHSA-wrcv-2hq2-rhwc

liteos_a has a race condition vulnerability

LOW 37

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00121 Published 2025-08-11 No fix listed CWE-362

TI-2025-20392 CVE-2025-27577 · GHSA-g7ff-v8fg-2hpr

liteos_a has a race condition vulnerability

LOW 37

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00113 Published 2025-08-11 No fix listed CWE-362

TI-2025-20096 CVE-2025-27247 · GHSA-j66c-q55p-63p7

Pasteboard has an improper preservation of permissions vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00134 Published 2025-06-08 No fix listed CWE-281

TI-2025-20092 CVE-2025-27242 · GHSA-fx8p-x9wh-4h4w

Ssecurity_component_manager has an improper input vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00138 Published 2025-06-08 No fix listed CWE-20

TI-2025-20382 CVE-2025-27563 · GHSA-9x6m-493j-h4m7

security_access_token has an improper preservation of permissions vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0013 Published 2025-06-08 No fix listed CWE-281

TI-2025-19627 CVE-2025-26693 · GHSA-mj5v-92gq-pg5q

security_access_token has an improper preservation of permissions vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0013 Published 2025-06-08 No fix listed CWE-281

TI-2025-19625 CVE-2025-26691 · GHSA-43hx-x24h-xvhj

telephony_call_manager has an improper preservation of permissions vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00134 Published 2025-06-08 No fix listed CWE-281

TI-2025-19988 CVE-2025-27131 · GHSA-2jv4-g2j5-gcgx

kernel_liteos_m has an improper input vulnerability

LOW 26

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00142 Published 2025-06-08 No fix listed CWE-20

TI-2025-18214 CVE-2025-24493 · GHSA-7c6q-rv7c-g9mh

kernel_liteos_a has a race condition vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00108 Published 2025-06-08 No fix listed CWE-362

TI-2025-18886 CVE-2025-25217 · GHSA-5h89-mf56-355j

arkui_ace_enginehas a NULL pointer dereference vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00138 Published 2025-06-08 No fix listed CWE-476

Vulnerabilities

Filters