CVE-2026-24918

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24918", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "state": "PUBLISHED", "assignerShortName": "huawei", "dateReserved": "2026-01-28T06:05:05.257Z", "datePublished": "2026-02-06T08:29:24.361Z", "dateUpdated": "2026-02-06T16:54:40.772Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "4.3.1"}]}, {"defaultStatus": "unaffected", "product": "EMUI", "vendor": "Huawei", "versions": [{"status": "affected", "version": "15.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Address read vulnerability in the communication module.<br>Impact: Successful exploitation of this vulnerability may affect availability."}], "value": "Address read vulnerability in the communication module.\nImpact: Successful exploitation of this vulnerability may affect availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:29:24.361Z"}, "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinvision/2026/2/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T16:54:21.422904Z", "id": "CVE-2026-24918", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:54:40.772Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24918", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "state": "PUBLISHED", "assignerShortName": "huawei", "dateReserved": "2026-01-28T06:05:05.257Z", "datePublished": "2026-02-06T08:29:24.361Z", "dateUpdated": "2026-02-06T16:54:40.772Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "4.3.1"}]}, {"defaultStatus": "unaffected", "product": "EMUI", "vendor": "Huawei", "versions": [{"status": "affected", "version": "15.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Address read vulnerability in the communication module.<br>Impact: Successful exploitation of this vulnerability may affect availability."}], "value": "Address read vulnerability in the communication module.\nImpact: Successful exploitation of this vulnerability may affect availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:29:24.361Z"}, "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinvision/2026/2/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24918", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T16:54:21.422904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:54:35.325Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "4.3.1"}]}, {"defaultStatus": "unaffected", "product": "EMUI", "vendor": "Huawei", "versions": [{"status": "affected", "version": "15.0.0"}]}], "source": "psirt@huawei.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:emui:15.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "888C5BD7-421B-4A85-8719-BFEE3C215527", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:4.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "6EA69843-EC8D-42E2-900E-017D2B502E9E", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E39DE6A6-CBE6-4086-93CD-113D1B3BA730", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:5.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "081B7AE1-10B8-45DD-813D-315E5CF51EBB", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0EBE30DD-E146-4A6A-BE68-DEF9D4D0B2A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Address read vulnerability in the communication module.\nImpact: Successful exploitation of this vulnerability may affect availability."}, {"lang": "es", "value": "Corregir vulnerabilidad de lectura en el m\u00f3dulo de comunicaci\u00f3n.\nImpacto: La explotaci\u00f3n exitosa de esta vulnerabilidad puede afectar la disponibilidad."}], "id": "CVE-2026-24918", "lastModified": "2026-06-17T10:23:48.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.2, "source": "psirt@huawei.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24918", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T16:54:21.422904Z", "version": "2.0.3"}}]}, "published": "2026-02-06T09:15:50.250", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinvision/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "psirt@huawei.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T18:24:34.613246+00:00", "value": {"mitigation_remediation": ["Download and install the latest firmware or OS update from Huawei that addresses the address\u2011read issue in the communication module.", "If an update is not yet available, limit exposure by disabling or restricting unnecessary network services that load the vulnerable component.", "Configure device firewall rules or network segmentation to block unsolicited traffic to the communication module interface, reducing potential exploitation vectors."], "summary": {"action": "Patch", "impact": "Denial of Service (availability)"}, "threat_synthesis": {"affected_systems": "Huawei Emui 15.0.0, Huawei HarmonyOS 4.3.1, 5.1.0, 5.1.1, and 6.0.0 are all impacted, as identified by the vendor\u2019s support bulletins for consumer devices, laptops, vision hardware, and wearables.", "description_and_impact": "A vulnerability in Huawei\u2019s communication module allows an attacker to read memory addresses, which could lead to a breakdown of the system\u2019s availability. The flaw may enable a user or malicious actor to cause a denial of service by disrupting normal operation of the affected OS.", "risk_and_exploitability": "The CVSS score of 6.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability that the vulnerability will be actively exploited. The flaw is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be related to the communication module, potentially allowing local or remote exploitation through network traffic or privileged processes. No specific exploitation method is detailed in the advisory, and no workaround is currently provided by the vendor."}}}}, "created": "2026-04-18T18:30:07.286496+00:00", "title": "Insecure Address Read in Huawei Communication Module Leading to Availability Impact", "updated": "2026-04-18T18:30:07.286510+00:00", "vendors": []}