Huawei Harmonyos vulnerabilities

CVE-2025-54609 [HIGH] CWE-125 CVE-2025-54609: Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of thi Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54607 [HIGH] CWE-295 CVE-2025-54607: Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of thi Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2025-54628 [HIGH] CWE-118 CVE-2025-54628: Vulnerability of incomplete verification information in the communication module. Impact: Successful Vulnerability of incomplete verification information in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54627 [HIGH] CWE-787 CVE-2025-54627: Out-of-bounds write vulnerability in the skia module. Impact: Successful exploitation of this vulner Out-of-bounds write vulnerability in the skia module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2025-54616 [MEDIUM] CWE-787 CVE-2025-54616: Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54642 [MEDIUM] CWE-20 CVE-2025-54642: Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. Im Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54645 [MEDIUM] CWE-129 CVE-2025-54645: Out-of-bounds array access issue due to insufficient data verification in the location service modul Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54653 [MEDIUM] CWE-22 CVE-2025-54653: Path traversal vulnerability in the virtualization file module. Successful exploitation of this vuln Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization file module.

CVE-2025-54639 [MEDIUM] CWE-502 CVE-2025-54639: ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this v ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exceptions.

CVE-2025-54620 [MEDIUM] CWE-502 CVE-2025-54620: Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitati Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54640 [MEDIUM] CWE-502 CVE-2025-54640: ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this v ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exceptions.

CVE-2025-54618 [MEDIUM] CWE-275 CVE-2025-54618: Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitatio Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2025-54636 [MEDIUM] CWE-20 CVE-2025-54636: Issue of buffer overflow caused by insufficient data verification in the kernel drop detection modul Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54652 [MEDIUM] CWE-22 CVE-2025-54652: Path traversal vulnerability in the virtualization base module. Successful exploitation of this vuln Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization module.

CVE-2025-54646 [MEDIUM] CWE-130 CVE-2025-54646: Vulnerability of inadequate packet length check in the BLE module. Impact: Successful exploitation o Vulnerability of inadequate packet length check in the BLE module. Impact: Successful exploitation of this vulnerability may affect performance.

CVE-2025-54624 [MEDIUM] CWE-275 CVE-2025-54624: Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitat Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54648 [MEDIUM] CWE-125 CVE-2025-54648: Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successf Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54625 [MEDIUM] CWE-414 CVE-2025-54625: Race condition vulnerability in the kernel file system module. Impact: Successful exploitation of th Race condition vulnerability in the kernel file system module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54611 [MEDIUM] CWE-840 CVE-2025-54611: EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2025-54608 [MEDIUM] CWE-264 CVE-2025-54608: Vulnerability that allows setting screen rotation direction without permission verification in the s Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of this vulnerability may cause device screen orientation to be arbitrarily set.