Huawei Harmonyos vulnerabilities

CVE-2026-24916 [MEDIUM] CWE-200 CVE-2026-24916: Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation o Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2024-56445 [MEDIUM] CWE-287 CVE-2024-56445: Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploit Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2024-39672 [HIGH] CWE-416 CVE-2024-39672: Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vul Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vulnerability will affect integrity and availability.

CVE-2025-54606 [HIGH] CWE-840 CVE-2025-54606: Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2025-58311 [HIGH] CWE-416 CVE-2025-58311: UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability wi UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2026-34859 [HIGH] CWE-416 CVE-2026-34859: UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will a UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2023-34157 [MEDIUM] CWE-290 CVE-2023-34157: Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may caus Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.

CVE-2026-58554 [MEDIUM] CWE-200 CVE-2026-58554: Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vul Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-41965 [MEDIUM] CWE-840 CVE-2026-41965: Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-41966 [MEDIUM] CWE-840 CVE-2026-41966: Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of th Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2025-58305 [MEDIUM] CWE-200 CVE-2025-58305: Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2021-22469 [HIGH] CWE-125 CVE-2021-22469: A component of the HarmonyOS has a Out-of-bounds Read vulnerability. Local attackers may exploit thi A component of the HarmonyOS has a Out-of-bounds Read vulnerability. Local attackers may exploit this vulnerability to cause kernel out-of-bounds read.

CVE-2024-39673 [HIGH] CWE-502 CVE-2024-39673: Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exp Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-41976 [MEDIUM] CWE-275 CVE-2026-41976: Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vul Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2022-48314 [MEDIUM] CWE-287 CVE-2022-48314: The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2022-48313 [MEDIUM] CWE-639 CVE-2022-48313: The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.

CVE-2025-54653 [MEDIUM] CWE-22 CVE-2025-54653: Path traversal vulnerability in the virtualization file module. Successful exploitation of this vuln Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization file module.

CVE-2021-40055 [MEDIUM] CVE-2021-40055: There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Su There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect integrity.

CVE-2022-44563 [MEDIUM] CWE-362 CVE-2022-44563: There is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerab There is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2025-58278 [MEDIUM] CWE-200 CVE-2025-58278: Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vul Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.