Vulnerabilities

TI-2026-25951 CVE-2026-33565 · GHSA-3hp3-3r3c-hw6c

kernel_linux_common_modules has a Race Condition vulnerability

LOW 15

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00094 Published 2026-05-19 No fix listed CWE-364

TI-2026-22942 CVE-2026-28733 · GHSA-g7x6-q2cp-cfqw

filemanagement_storage_service has an use after free vulnerability

LOW 28

in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00131 Published 2026-05-19 No fix listed CWE-416

TI-2026-22124 CVE-2026-27766 · GHSA-382c-r87v-m473

multimedia_audio_framework has a Race Condition vulnerability

LOW 24

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00103 Published 2026-05-19 No fix listed CWE-364

TI-2026-20895 CVE-2026-25850 · GHSA-vg48-6574-px53

filemanagement_storage_service has an improper preservation of permissions vulnerability

LOW 24

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00118 Published 2026-05-19 No fix listed CWE-281

TI-2026-20847 CVE-2026-25781 · GHSA-7f33-7337-2rhg

kernel_liteos_a has an out-of-bounds write vulnerability

LOW 37

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00132 Published 2026-05-19 No fix listed CWE-787

TI-2026-22951 CVE-2026-28751 · GHSA-7gq8-55gr-wpmv

filemanagement_storage_service has an improper input validation vulnerability

LOW 15

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.0012 Published 2026-05-19 No fix listed CWE-20

TI-2026-22139 CVE-2026-27781 · GHSA-ghh2-q8rr-q487

kernel_liteos_a has an integer overflow vulnerability

LOW 15

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00117 Published 2026-05-19 No fix listed CWE-190

TI-2026-22030 CVE-2026-27648 · GHSA-fpp4-pf9w-p6rr

web_webview has an out-of-bounds write vulnerability

MEDIUM 41

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00552 Published 2026-05-19 No fix listed CWE-787

TI-2026-20273 CVE-2026-25110 · GHSA-5x4c-vwv3-ghp2

Sensors_medical_sensor has a NULL pointer dereference vulnerability

LOW 15

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.0012 Published 2026-05-19 No fix listed CWE-476

TI-2026-19991 CVE-2026-24792 · GHSA-mv6m-pvcq-372p

web_webview has a Race Condition vulnerability

LOW 38

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00428 Published 2026-05-19 No fix listed CWE-364

TI-2025-06337 CVE-2025-6969 · GHSA-56j9-gv37-wm36

ability_ability_runtime an improper input validation vulnerability

LOW 24

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00154 Published 2026-03-16 No fix listed CWE-20

TI-2025-19421 CVE-2025-26474 · GHSA-vr6x-jjgx-5wwg

communication_ipc an improper input validation vulnerability

LOW 15

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00143 Published 2026-03-16 No fix listed CWE-20

TI-2025-32586 CVE-2025-52458 · GHSA-v8r2-jx92-x3gr

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

LOW 33

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00167 Published 2026-03-16 No fix listed CWE-787

TI-2025-27596 CVE-2025-41432 · GHSA-q3qm-rvx8-4rrq

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

LOW 33

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00179 Published 2026-03-16 No fix listed CWE-787

TI-2025-18931 CVE-2025-25277 · GHSA-9jcr-498r-jxxc

arkcompiler_ets_runtime has a type confusion vulnerability

LOW 32

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00157 Published 2026-03-16 No fix listed CWE-843

TI-2025-11672 CVE-2025-12736 · GHSA-2c6c-mrq5-cw27

multimedia_audio_standard has an insecure storage of sensitive information vulnerability

LOW 28

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00174 Published 2026-03-16 No fix listed CWE-908

TI-2026-00436 CVE-2026-0639 · GHSA-7wx7-hcfj-9cvg

liteos_a has a missing release of memory vulnerability

LOW 24

in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00161 Published 2026-03-16 No fix listed CWE-401

TI-2025-20381 CVE-2025-27562 · GHSA-m2mf-qqpm-8vch

communication_dsoftbus has a missing release of memory vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-401

TI-2025-19985 CVE-2025-27128 · GHSA-xc48-fv99-qvrm

liteos_a has an UAF vulnerability

LOW 38

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00159 Published 2025-08-11 No fix listed CWE-416

TI-2025-18881 CVE-2025-25212 · GHSA-qg6v-4fp5-q658

pasteboard has an improper input vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-20

TI-2025-18553 CVE-2025-24844 · GHSA-7427-8ggf-g35c

communication_dsoftbus has a missing release of memory vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-401

TI-2025-20365 CVE-2025-27536 · GHSA-r4pq-968w-g9qp

arkcompiler_ets_runtime has a type confusion vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-843

TI-2025-19624 CVE-2025-26690 · GHSA-q7f5-h647-x236

communication dsoftbus has a NULL pointer vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-476

TI-2025-18626 CVE-2025-24925 · GHSA-5mrq-2j6g-h4pf

applications_settings has a missing release of memory vulnerability

LOW 24

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2025-08-11 No fix listed CWE-401

TI-2025-18044 CVE-2025-24298 · GHSA-xwf4-4p9v-22fp

liteos_a has an UAF vulnerability

LOW 38

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00159 Published 2025-08-11 No fix listed CWE-416

Vulnerabilities

Filters