CVE-2026-24922

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24922", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "state": "PUBLISHED", "assignerShortName": "huawei", "dateReserved": "2026-01-28T06:05:05.257Z", "datePublished": "2026-02-06T08:32:12.061Z", "dateUpdated": "2026-02-06T16:40:40.680Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "6.0.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Buffer overflow vulnerability in the HDC module.<br>Impact: Successful exploitation of this vulnerability may affect availability."}], "value": "Buffer overflow vulnerability in the HDC module.\nImpact: Successful exploitation of this vulnerability may affect availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:32:12.061Z"}, "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T16:40:16.194742Z", "id": "CVE-2026-24922", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:40:40.680Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T16:40:16.194742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:40:22.973Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Huawei", "product": "HarmonyOS", "versions": [{"status": "affected", "version": "6.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Buffer overflow vulnerability in the HDC module.\nImpact: Successful exploitation of this vulnerability may affect availability.", "supportingMedia": [{"type": "text/html", "value": "Buffer overflow vulnerability in the HDC module.<br>Impact: Successful exploitation of this vulnerability may affect availability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:32:12.061Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24922", "state": "PUBLISHED", "dateUpdated": "2026-02-06T16:40:40.680Z", "dateReserved": "2026-01-28T06:05:05.257Z", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "datePublished": "2026-02-06T08:32:12.061Z", "assignerShortName": "huawei"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "6.0.0"}]}], "source": "psirt@huawei.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:harmonyos:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0EBE30DD-E146-4A6A-BE68-DEF9D4D0B2A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow vulnerability in the HDC module.\nImpact: Successful exploitation of this vulnerability may affect availability."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer en el m\u00f3dulo HDC.\nImpacto: La explotaci\u00f3n exitosa de esta vulnerabilidad puede afectar la disponibilidad."}], "id": "CVE-2026-24922", "lastModified": "2026-06-17T10:23:48.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 5.3, "source": "psirt@huawei.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24922", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T16:40:16.194742Z", "version": "2.0.3"}}]}, "published": "2026-02-06T09:15:50.730", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/2/"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "psirt@huawei.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:50:23.177820+00:00", "value": {"mitigation_remediation": ["Check Huawei\u2019s support portal for an update that fixes the buffer overflow in the HDC module of HarmonyOS\u202f6.0.0.", "Apply the vendor\u2011released patch following Huawei\u2019s installation instructions.", "If no patch is currently available, reduce exposure by disabling or limiting the use of the HDC module and restricting network access it relies on.", "Continuously monitor device logs for crash events or unusual availability issues and verify that applications using the HDC module handle malformed input safely."], "summary": {"action": "Assess Impact", "impact": "Availability"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Huawei HarmonyOS version 6.0.0, as deployed across consumer devices, laptops, and wearables. The affected component is the HDC module.", "description_and_impact": "Buffer overflow in the HDC module of Huawei HarmonyOS can enable the application to crash when it processes malformed input. The weakness corresponds to CWE\u2011120 and CWE\u2011122 and is limited to a loss of service; no confidentiality or integrity compromise is witnessed in the provided description.", "risk_and_exploitability": "The CVSS base score of 6.9 classifies the issue as medium severity, while the EPSS figure of less than 1\u202f% indicates a very low probability of exploitation. The issue has not been catalogued in the CISA KEV list. The exact attack vector is not specified, but the buffer overflow suggests exploitation via the HDC module; it may be triggered by malformed data from a local or connected source, though remote execution is not confirmed by the description."}}}}, "created": "2026-02-09T10:52:36.387699+00:00", "title": "Buffer Overflow in HarmonyOS HDC Module", "updated": "2026-04-17T23:00:12.621845+00:00", "vendors": ["huawei", "huawei$PRODUCT$harmonyos"]}