CVE-2026-24792

web_webview has a Race Condition vulnerability

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-28751

filemanagement_storage_service has an improper input validation vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-25110

Sensors_medical_sensor has a NULL pointer dereference vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-27648

web_webview has an out-of-bounds write vulnerability

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-27781

kernel_liteos_a has an integer overflow vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-27766

multimedia_audio_framework has a Race Condition vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-25781

kernel_liteos_a has an out-of-bounds write vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-25850

filemanagement_storage_service has an improper preservation of permissions vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-28733

filemanagement_storage_service has an use after free vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-33565

kernel_linux_common_modules has a Race Condition vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openharmony

Products

Openharmony

CVE-2026-0639

liteos_a has a missing release of memory vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2025-12736

multimedia_audio_standard has an insecure storage of sensitive information vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2025-25277

arkcompiler_ets_runtime has a type confusion vulnerability

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2025-41432

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2025-52458

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2025-26474

communication_ipc an improper input validation vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2025-6969

ability_ability_runtime an improper input validation vulnerability

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2024-54030

Communication_dsoftbus has an UAF vulnerability

in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2024-47398

Liteos_a has an out-of-bounds write vulnerability

in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony

CVE-2024-45070

Liteos_a has an out-of-bounds read vulnerability

in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom Openharmony

Products

Openharmony Openharmony