CVE-2026-24925

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24925", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "state": "PUBLISHED", "assignerShortName": "huawei", "dateReserved": "2026-01-28T06:05:05.257Z", "datePublished": "2026-02-06T08:22:34.554Z", "dateUpdated": "2026-02-06T17:36:08.896Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "5.1.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Heap-based buffer overflow vulnerability in the image module.<br>Impact: Successful exploitation of this vulnerability may affect availability."}], "value": "Heap-based buffer overflow vulnerability in the image module.\nImpact: Successful exploitation of this vulnerability may affect availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:22:34.554Z"}, "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T17:36:00.813663Z", "id": "CVE-2026-24925", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T17:36:08.896Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24925", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T17:36:00.813663Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T17:36:05.433Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Huawei", "product": "HarmonyOS", "versions": [{"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "5.1.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow vulnerability in the image module.\nImpact: Successful exploitation of this vulnerability may affect availability.", "supportingMedia": [{"type": "text/html", "value": "Heap-based buffer overflow vulnerability in the image module.<br>Impact: Successful exploitation of this vulnerability may affect availability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2026-02-06T08:22:34.554Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24925", "state": "PUBLISHED", "dateUpdated": "2026-02-06T17:36:08.896Z", "dateReserved": "2026-01-28T06:05:05.257Z", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "datePublished": "2026-02-06T08:22:34.554Z", "assignerShortName": "huawei"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HarmonyOS", "vendor": "Huawei", "versions": [{"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "5.1.0"}]}], "source": "psirt@huawei.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:harmonyos:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E39DE6A6-CBE6-4086-93CD-113D1B3BA730", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0EBE30DD-E146-4A6A-BE68-DEF9D4D0B2A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow vulnerability in the image module.\nImpact: Successful exploitation of this vulnerability may affect availability."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en el m\u00f3dulo de imagen.\nImpacto: La explotaci\u00f3n exitosa de esta vulnerabilidad puede afectar la disponibilidad."}], "id": "CVE-2026-24925", "lastModified": "2026-06-17T10:23:49.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.7, "source": "psirt@huawei.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24925", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T17:36:00.813663Z", "version": "2.0.3"}}]}, "published": "2026-02-06T09:15:51.023", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2026/2/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "psirt@huawei.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:52:22.233827+00:00", "value": {"mitigation_remediation": ["Check the Huawei support bulletin for an update to HarmonyOS 5.1.0 and 6.0.0 and apply any released patch that addresses the image module overflow.", "Restrict or disable the use of the vulnerable image processing functions in applications that handle untrusted data until a patch is applied to reduce the attack surface.", "Continuously monitor system logs for errors related to image processing and investigate any abnormal restarts or elevated memory usage that could indicate an attempted exploitation."], "summary": {"action": "Assess Impact", "impact": "Availability"}, "threat_synthesis": {"affected_systems": "Huawei HarmonyOS versions 5.1.0 and 6.0.0 are affected by the heap overflow in the image module. These versions of the operating system include the vulnerable component that processes image files.", "description_and_impact": "The vulnerability is a heap\u2011based buffer overflow in the image module of Huawei HarmonyOS. When malformed image data is processed, the corruption can overwrite adjacent memory, potentially causing the image handling service to crash and denying service availability. No direct compromise of confidentiality or integrity is reported in the official description.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high severity, while the EPSS score of less than 1% suggests that current exploitation attempts are extremely rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is not explicitly stated, but it is inferred that delivering a specially crafted image\u2014either locally or over a network interface that accepts image input\u2014could trigger the overflow. No exploit code is documented, so the likelihood of public exploitation remains low at present."}}}}, "created": "2026-02-09T10:52:51.771208+00:00", "title": "Heap-Based Buffer Overflow in Image Module", "updated": "2026-04-17T23:00:12.638839+00:00", "vendors": ["huawei", "huawei$PRODUCT$harmonyos"]}