Huawei Harmonyos vulnerabilities

CVE-2024-51522 [MEDIUM] CWE-199 CVE-2024-51522: Vulnerability of improper device information processing in the device management module Impact: Succ Vulnerability of improper device information processing in the device management module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-51517 [MEDIUM] CWE-129 CVE-2024-51517: Vulnerability of improper memory access in the phone service module Impact: Successful exploitation Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-51520 [MEDIUM] CWE-20 CVE-2024-51520: Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitati Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-46592 [MEDIUM] CWE-476 CVE-2025-46592: Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-51519 [MEDIUM] CWE-20 CVE-2024-51519: Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitati Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54639 [MEDIUM] CWE-502 CVE-2025-54639: ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this v ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exceptions.

CVE-2025-54640 [MEDIUM] CWE-502 CVE-2025-54640: ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this v ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exceptions.

CVE-2024-56453 [MEDIUM] CWE-120 CVE-2024-56453: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine modu Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-56456 [MEDIUM] CWE-120 CVE-2024-56456: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine modu Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-5465 [MEDIUM] CWE-264 CVE-2024-5465: Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerabilit Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2024-36503 [MEDIUM] CWE-908 CVE-2024-36503: Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulner Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2025-58280 [MEDIUM] CWE-1321 CVE-2025-58280: Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitati Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-56455 [MEDIUM] CWE-120 CVE-2024-56455: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine modu Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-56454 [MEDIUM] CWE-120 CVE-2024-56454: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine modu Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-51529 [MEDIUM] CWE-20 CVE-2024-51529: Data verification vulnerability in the battery module Impact: Successful exploitation of this vulne Data verification vulnerability in the battery module Impact: Successful exploitation of this vulnerability may affect function stability.

CVE-2025-54616 [MEDIUM] CWE-787 CVE-2025-54616: Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54614 [MEDIUM] CWE-20 CVE-2025-54614: Input verification vulnerability in the home screen module. Impact: Successful exploitation of this Input verification vulnerability in the home screen module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2024-51521 [MEDIUM] CWE-269 CVE-2024-51521: Input parameter verification vulnerability in the background service module Impact: Successful explo Input parameter verification vulnerability in the background service module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2021-22419 [MEDIUM] CWE-345 CVE-2021-22419: A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Loc A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to cause persistent dos.

CVE-2025-54638 [MEDIUM] CWE-502 CVE-2025-54638: Issue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation of Issue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation of this vulnerability may affect the availability of the ad service.