CVE-2026-24921

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24921", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "state": "PUBLISHED", "assignerShortName": "huawei", "dateReserved": "2026-01-28T06:05:05.257Z", "datePublished": "2026-02-06T08:30:44.503Z", "dateUpdated": "2026-02-06T16:53:12.075Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "6.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Address read vulnerability in the HDC module.<br>Impact: Successful exploitation of this vulnerability will affect availability and confidentiality."}], "value": "Address read vulnerability in the HDC module.\nImpact: Successful exploitation of this vulnerability will affect availability and confidentiality."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:30:44.503Z"}, "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T16:52:33.734639Z", "id": "CVE-2026-24921", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:53:12.075Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T16:52:33.734639Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:53:04.167Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Huawei", "product": "HarmonyOS", "versions": [{"status": "affected", "version": "6.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Address read vulnerability in the HDC module.\nImpact: Successful exploitation of this vulnerability will affect availability and confidentiality.", "supportingMedia": [{"type": "text/html", "value": "Address read vulnerability in the HDC module.<br>Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:30:44.503Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24921", "state": "PUBLISHED", "dateUpdated": "2026-02-06T16:53:12.075Z", "dateReserved": "2026-01-28T06:05:05.257Z", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "datePublished": "2026-02-06T08:30:44.503Z", "assignerShortName": "huawei"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "6.0.0"}]}], "source": "psirt@huawei.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:harmonyos:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0EBE30DD-E146-4A6A-BE68-DEF9D4D0B2A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Address read vulnerability in the HDC module.\nImpact: Successful exploitation of this vulnerability will affect availability and confidentiality."}, {"lang": "es", "value": "Abordar vulnerabilidad de lectura en el m\u00f3dulo HDC.\nImpacto: La explotaci\u00f3n exitosa de esta vulnerabilidad afectar\u00e1 la disponibilidad y la confidencialidad."}], "id": "CVE-2026-24921", "lastModified": "2026-06-17T10:23:48.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 4.2, "source": "psirt@huawei.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24921", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T16:52:33.734639Z", "version": "2.0.3"}}]}, "published": "2026-02-06T09:15:50.583", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@huawei.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:50:48.415912+00:00", "value": {"mitigation_remediation": ["Install the security update released in the February 2026 Huawei consumer bulletins that patches the HDC module toward HarmonyOS 6.0.0.", "Upgrade to the latest HarmonyOS release (such as 6.1.0 or newer) once it is available through official channels.", "Limit or disable the use of the HDC component by configuring app permissions or device policies until the patch is applied, reducing the attack surface relevant to CWE\u2011125."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure and Service Disruption"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Huawei HarmonyOS operating systems, specifically the 6.0.0 build found on phones, tablets, laptops, and wearable devices as listed by Huawei\u2019s consumer support bulletins for February 2026.", "description_and_impact": "A buffer overread flaw exists in the HarmonyOS HDC module, which can enable an attacker to read adjacent memory. Successful exploitation may expose private data and cause application instability or system crashes, leading to loss of confidentiality and availability.", "risk_and_exploitability": "The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% points to a low likelihood of widespread exploitation. The vulnerability is not listed in the KEV catalog, and no official workaround is available. Based on the description, the attack vector is likely local to the device, requiring interaction with the HDC module. The combination of moderate CVSS and very low EPSS suggests that while the potential impact is significant, the probability of real-world exploitation remains minimal at present."}}}}, "created": "2026-02-09T10:52:24.090674+00:00", "title": "Address Read Vulnerability in HarmonyOS HDC Module Leading to Information Disclosure and Potential Downtime", "updated": "2026-04-17T23:00:12.626955+00:00", "vendors": ["huawei", "huawei$PRODUCT$harmonyos"]}