CVE-2025-26474

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios...

CVE-2025-12736

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource...

CVE-2025-6969 ability_ability_runtime an improper input validation vulnerability

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input...

CVE-2025-26474 communication_ipc an improper input validation vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios...

CVE-2025-26474

CVE-2025-26474 affects OpenHarmony v5.0.3 and earlier. The issue stems from improper input validation in the communication_ipc pathway, enabling a local attacker to cause information disclosure in restricted scenarios. CVSSv3.1 base score 3.3 (LOW) with LOCAL attack vector, LOW privileges require...

CVE-2025-26474

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios...

CVE-2025-41432

CVE-2025-41432 is an out-of-bounds write vulnerability affecting OpenHarmony up to v5.1.0. The issue is present in arkcompiler_ets_runtime and allows a local attacker to execute arbitrary code within pre-installed apps. The impact is described as high for confidentiality, integrity, and availabil...

CVE-2025-12736

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource...

CVE-2025-12736 multimedia_audio_standard has an insecure storage of sensitive information vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource...

CVE-2026-0639 liteos_a has a missing release of memory vulnerability

in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory...

CVE-2026-21002

Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application...

CVE-2026-21002

Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application...

CVE-2026-21002

Galaxy Store before version 4.6.03.8 suffers from improper verification of cryptographic signatures, enabling a local attacker to install arbitrary applications. This CVE entry (CVE-2026-21002) has a connected vulnerability record (EUVD-2026-12321) that specifies the root cause and impact. Affect...

CVE-2026-21001

Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

CVE-2026-21001

Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

CVE-2026-21001

Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

CVE-2026-21001

CVE-2026-21001 appears as a reserved entry in initial data. Connected record EUVD-2026-12319 documents a concrete vulnerability: path traversal in Galaxy Store before 4.6.03.8, enabling a local attacker to create files with Galaxy Store privileges. The affected component is Galaxy Store; the impa...

CVE-2026-21000

Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

CVE-2026-21000

Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

CVE-2026-21000

Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...