Huawei Harmonyos vulnerabilities

CVE-2024-56435 [HIGH] CWE-1021 CVE-2024-56435: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation o Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-54112 [HIGH] CWE-1021 CVE-2024-54112: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation o Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-56436 [HIGH] CWE-1021 CVE-2024-56436: Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation o Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2025-54610 [HIGH] CWE-129 CVE-2025-54610: Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of thi Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54609 [HIGH] CWE-125 CVE-2025-54609: Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of thi Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-54114 [HIGH] CWE-754 CVE-2024-54114: Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2024-56434 [HIGH] CWE-416 CVE-2024-56434: UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerabi UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.

CVE-2021-37016 [CRITICAL] CWE-125 CVE-2021-37016: There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vul There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause Information Disclosure or Denial of Service.

CVE-2025-46590 [MEDIUM] CWE-287 CVE-2025-46590: Bypass vulnerability in the network search instruction authentication module Impact: Successful expl Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypass authentication and enable access to some network search functions.

CVE-2021-22376 [HIGH] CWE-269 CVE-2021-22376: A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions.

CVE-2023-34154 [HIGH] CWE-732 CVE-2023-34154: Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of thi Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.

CVE-2023-26547 [HIGH] CWE-502 CVE-2023-26547: The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exp The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2021-22416 [HIGH] CVE-2021-22416: A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution.

CVE-2021-22420 [HIGH] CWE-668 CVE-2021-22420: A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause the underlying trust of the application trustlist mechanism is missing..

CVE-2022-34742 [HIGH] CWE-125 CVE-2022-34742: The system module has a read/write vulnerability. Successful exploitation of this vulnerability may The system module has a read/write vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-40027 [HIGH] CWE-476 CVE-2021-40027: The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2025-54655 [HIGH] CWE-367 CVE-2025-54655: Race condition vulnerability in the virtualization base module. Successful exploitation of this vuln Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality and integrity of the virtualization graphics module.

CVE-2021-40065 [HIGH] CVE-2021-40065: The communication module has a service logic error vulnerability.Successful exploitation of this vul The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-37037 [HIGH] CVE-2021-37037: There is an Invalid address access vulnerability in Huawei Smartphone.Successful exploitation of thi There is an Invalid address access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart.

CVE-2021-37075 [HIGH] CVE-2021-37075: There is a Credentials Management Errors vulnerability in Huawei Smartphone.Successful exploitation There is a Credentials Management Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to confidentiality affected.