CVE-2024-28226

CVE-2024-28226 affects OpenHarmony prior to 4.0.0. A remote attacker can cause a Denial of Service via improper input handling in the OpenHarmony stack, impacting availability (CVE text cites DOS; CVSS indicates High impact). Root cause cited in CVE records is improper input validation. Affected ...

CVE-2024-36260

CVE-2024-36260 affects OpenHarmony, with Arkcompiler Ets Runtime vulnerable to an out-of-bounds write that could enable remote code execution in pre-installed apps on OpenHarmony v4.0.0 and earlier. The issue is described as a remote code execution risk; no exploit details are provided in the sou...

CVE-2024-38382

CVE-2024-38382 affects OpenHarmony v4.0.0 and earlier. It enables a local attacker to cause an information leak via an out-of-bounds read in the affected code path. The vulnerability is described as a local, low-complexity issue with high confidentiality impact, requiring no user interaction. Aff...

CVE-2022-41802

OpenHarmony kernel_liteos_a (OpenHarmony v3.1.4 and earlier) is affected by a kernel stack overflow when SysClockGetres is called. The issue leaks 4 bytes of padding data from the kernel stack to user space. The vulnerability is documented across multiple sources with affected versions and relate...

CVE-2023-24465

CVE-2023-24465 affects the OpenHarmony Wi‑Fi subsystem in OpenHarmony v3.1.4 and earlier (and v3.0.7 and earlier). The vulnerability is a null pointer dereference in the Communication Wi‑Fi subsystem, exploitable by local attackers to crash the current application (local impact). The issue is tie...

CVE-2024-21860

CVE-2024-21860 affects OpenHarmony versions 4.0.0 and earlier. The publicly documented issue is a use-after-free in Dsoftbus that enables an adjacent attacker to execute arbitrary code in any application. The impact is described as high across confidentiality, integrity, and availability in at le...

CVE-2024-45382

The CVE-2024-45382 entry concerns OpenHarmony v4.1.0 and earlier. A local attacker can cause a denial-of-service via an out-of-bounds write in the affected component/function (root cause described as an out-of-bounds write). Public sources consolidate this vulnerability as local with low privileg...

CVE-2023-0036

CVE-2023-0036 affects OpenHarmony v3.0.5 and earlier. The vulnerability is in the platform_callback_stub of the misc subsystem, causing an authentication bypass that enables a local attacker to bypass authentication and target other SAs with high privileges. No exploitation details are provided i...

CVE-2024-0285

CVE-2024-0285 affects OpenHarmony (Dsoftbus) v4.0.0 and earlier. The vulnerability arises from improper input validation in the Dsoftbus component, allowing a local attacker to trigger a denial of service. NVD notes a local attack vector with medium base score and high availability impact; OpenHa...

CVE-2024-28044

Summary of CVE-2024-28044 : OpenHarmony (prior to v4.1.0) is affected by an integer overflow in LiteOS-A that allows a local attacker to cause a crash. The issue is described as a local vulnerability with a low attack complexity and requires LOW privileges with no user interaction, leading to ava...

CVE-2024-43696

CVE-2024-43696 affects OpenHarmony v4.1.0 and earlier. The issue is a local memory-leak vulnerability that can allow a local attacker to cause a denial of service (DOS). The underlying cause is a memory leak that impacts system availability; CVSS vectors in the records show local access with low ...

CVE-2025-20081

CVE-2025-20081 affects OpenHarmony v5.0.2 and earlier, with a use-after-free in the Dsoftbus/communication path that enables local arbitrary code execution in pre-installed apps under restricted conditions. The issue is described consistently across multiple sources; exploitation appears local an...

CVE-2022-43662

CVE-2022-43662 : OpenHarmony v3.1.4 and earlier (kernel_liteos_a) expose a kernel stack overflow in SysTimerGettime that leaks 4 bytes of kernel-stack padding to user space. Affects OpenHarmony’s kernel subsystem; impact is leakage of data with local access. Documented affected component: kernel_...

CVE-2023-3116

CVE-2023-3116 affects OpenHarmony v3.2.2 and earlier, where local attackers can obtain confidential information or rewrite sensitive files due to incorrect default permissions. The issue is detailed across multiple sources (NVD/CNVD/PRION/CVE lists) with a local attack vector and no user interact...

CVE-2023-43612

OpenHarmony vulnerability CVE-2023-43612 affects OpenHarmony v3.2.2 and earlier. Root cause: improper preservation of permissions allowing a local attacker to read and write arbitrary files. Impact is high (confidentiality, integrity, availability). Exploitation is local with low rights and no us...

CVE-2024-36278

CVE-2024-36278 affects OpenHarmony, specifically versions before 4.0.0. The root cause is a type confusion vulnerability in Arkcompiler Ets Runtime that can be triggered by a local attacker, leading to application crashes (availability impact). The CVE description states the issue exists in OpenH...

CVE-2024-37077

CVE-2024-37077 affects OpenHarmony v4.0.0 and earlier, with an out-of-bounds write in the Arkcompiler Ets Runtime enabling a remote attacker to execute arbitrary code in pre-installed apps. Exploitation details are not provided in the initial documents, but multiple sources confirm the remote-cod...

CVE-2024-38386

OpenHarmony CVE-2024-38386 affects v4.1.0 and earlier, with a local arbitrary-code-execution via an out-of-bounds write in the Ark eTS/Arkcompiler runtime. The issue enables local attackers to run code within pre-installed apps. The public documents consistently describe the vulnerability as an o...

CVE-2023-48360

OpenHarmony CVE-2023-48360 affects OpenHarmony v3.2.2 and earlier, where a local attacker can crash the multimedia player by modifying a released pointer (use-after-free). The issue is characterized as a local impact with availability impact, caused by reusing a pointer released from the multimed...

CVE-2024-21863

OpenHarmony vulnerability CVE-2024-21863 affects Dsoftbus: improper input validation in OpenHarmony v4.0.0 and prior versions can allow a local attacker to cause a denial-of-service. The core issue is input validation in Dsoftbus leading to resource exhaustion or crash when processing inputs. Aff...

CVE-2025-27247

OpenHarmony CVE-2025-27247 affects OpenHarmony v5.0.3 and earlier. The issue allows a local attacker to cause information leakage via the get permission mechanism. The root cause described across sources is improper handling/preservation of permissions in the pasteboard/permission flow, enabling ...

CVE-2023-49118

OpenHarmony vulnerability CVE-2023-49118 affects v3.2.4 and earlier, where an out-of-bounds read in the Dsoftbus/OpenHarmony stack allows a local attacker to cause information leakage. The issue is documented across multiple feeds (NVD/Red Hat/EUVD) and is associated with OpenHarmony’s local-atta...

CVE-2023-42774

OpenHarmony vulnerability CVE-2023-42774 affects OpenHarmony v3.2.2 and earlier. The issue arises from incorrect default permissions that allow a local attacker to obtain confidential information (high confidentiality impact; local access; no user interaction). The root cause is insufficient perm...

CVE-2023-43756

OpenHarmony prior to and including v3.2.4 is affected by a local information-leak due to an out-of-bounds read in the Dsoftbus component. The CVE entry documents OpenHarmony v3.2.4 and earlier as vulnerable, with exploitation requiring local access and resulting in confidentiality impact. Remedia...

CVE-2023-46100

OpenHarmony vulnerability CVE-2023-46100 affects OpenHarmony v3.2.2 and prior. Root cause: use of an uninitialized resource that can disclose sensitive buffer information to a local attacker. Impact centers on confidentiality (high) with no known integrity/availability impact stated. CVSS metrics...

CVE-2023-4753

CVE-2023-4753 concerns OpenHarmony: v3.2.1 and earlier are affected by a system call function usage error in the liteos-a kernel. The vulnerability can cause a local attacker to crash the kernel via malformed input, per the NVD description. Connected sources corroborate the OpenHarmony context an...

CVE-2023-6045

OpenHarmony is affected by CVE-2023-6045 (OpenHarmony v3.2.2 and earlier). The vulnerability stems from a type confusion in pre-installed apps that enables a local attacker to achieve arbitrary code execution. Affected component details specify local attack, with practical impact described as arb...

CVE-2024-31071

OpenHarmony is affected by CVE-2024-31071: prior to v4.0.0, a local attacker can trigger a type confusion vulnerability that causes applications to crash. The issue is described as a local, low-severity fault with availability impact (availability impact is noted as LOW; attack vector LOCAL; priv...

CVE-2024-37030

OpenHarmony CVE-2024-37030 affects OpenHarmony v4.0.0 and earlier; the vulnerability is described as a use-after-free in Arkcompiler Ets Runtime that enables a remote attacker to execute arbitrary code in pre-installed apps. The CVSS information indicates a network-exposed, highly severe impact w...

CVE-2024-54030

OpenHarmony CVE-2024-54030 affects v4.1.2 and earlier. The issue is a use-after-free in Communication_dsoftbus/memory handling that allows a local attacker to cause a denial of service. The published descriptions consistently state a local DOS impact, with no remote/vector details provided. Core ...

CVE-2024-39612

OpenHarmony CVE-2024-39612 affects OpenHarmony v4.0.0 and earlier. The issue is an out-of-bounds read that enables a local attacker to cause information leakage. Multiple sources (including Red Hat and CVE records) confirm the vulnerability description; exploitation is local, with low attack comp...

CVE-2024-45070

CVE-2024-45070 affects OpenHarmony (v4.1.2 and earlier). The vulnerability is an out-of-bounds read that enables a local attacker to cause an information leak. The description specifies a local-attack scenario and a confidentiality impact (high in CVSS) without indicating remote code execution. C...

CVE-2022-38701

CVE-2022-38701 describes a heap overflow in the OpenHarmony IPC/communication subsystem affecting OpenHarmony v3.1.2 and earlier. The vulnerability enables a local attacker to trigger a heap overflow and potentially access network-sensitive information. Publicly referenced sources (e.g., CVE reco...

CVE-2022-41686

OpenHarmony OpenHarmony v3.1.2 and prior (including 3.0.6 and older) are affected by an out-of-bounds memory read/write vulnerability in the /dev/mmz_userdev device driver. An unprivileged process could read memory out of bounds, potentially leading to information disclosure; processes with syste...

CVE-2022-45126

OpenHarmony kernel_liteos_a (OpenHarmony v3.1.4 and earlier) contains a kernel stack overflow in the kernel subsystem when SysClockGettime is called. 4 bytes of padding data from the kernel stack are copied to user space and leaked. Impact per CVSS vectors is High for confidentiality, integrity, ...

CVE-2023-47857

CVE-2023-47857 affects OpenHarmony v3.2.2 and earlier. The issue is a use-after-release of a multimedia camera component pointer, enabling a local attacker to crash the camera. Root cause: pointer is released and then reused, leading to a crash (UAF) in the camera subsystem. Public references des...

CVE-2023-45734

CVE-2023-45734 affects OpenHarmony v3.2.4 and earlier, with the Dsoftbus component vulnerable to an out-of-bounds write that enables an adjacent attacker to execute arbitrary code. The issue is documented across multiple feeds (e.g., Red Hat, CVE lists) and is characterized by a high-impact vecto...

CVE-2023-49142

CVE-2023-49142 affects OpenHarmony versions 3.2.2 and earlier. The issue is a use-after-free in a multimedia audio component caused by modifying a released pointer, enabling a local attacker to trigger a multimedia audio crash. Impact is limited to availability (crash) per documented metrics; no ...

CVE-2023-47216

OpenHarmony v3.2.2 and earlier are affected by a local denial-of-service vulnerability described as a missing release of Liteos-A resources. The underlying issue appears to be an unreleased Liteos-A resource that can be exploited by a local attacker to occupy all resources, causing DOS. The conne...

CVE-2025-24844

The CVE-2025-24844 entry involves OpenHarmony, affected in v5.0.3 and earlier. The root cause is a missing release of memory, leading to a local denial-of-service condition (availability impact), as described by multiple sources. Exploitation is local with low attack complexity and low privileges...

CVE-2025-25278

OpenHarmony CVE-2025-25278 affects OpenHarmony v5.0.3 and earlier due to a race condition in the tcb component that can allow a local attacker to execute arbitrary code. The root cause is a race condition in tcb leading to local code execution with high impact; exploitability is local with no use...

CVE-2025-26690

CVE-2025-26690 affects OpenHarmony v5.0.3 and earlier. The issue is a NULL pointer dereference that allows a local attacker to cause a denial of service. Impact described in multiple sources: local-access DOS with HIGH availability impact; CVSS vectors report MEDIUM to LOW/LOWmeasures, but offici...

CVE-2025-24298

CVE-2025-24298 relates to OpenHarmony, affecting v5.0.3 and earlier where a use-after-free in the trusted computing base (tcb) enables a local attacker to achieve arbitrary code execution. The vulnerability is locally exploitable due to tcb’s post-release reuse issue, with impact on confidentiali...

CVE-2025-25212

CVE-2025-25212 affects OpenHarmony, with versions v5.0.3 and earlier vulnerable to local DoS due to improper input handling. The issue is a local-attack vector, leading to denial of service as described in multiple sources (e.g., PT-2025-32508). The most concrete remediation is to upgrade to Open...

CVE-2025-27128

CVE-2025-27128 affects OpenHarmony v5.0.3 and earlier, with a use-after-free in the tcb component allowing a local attacker to execute arbitrary code. The vulnerability path is local with low privileges required and no user interaction, yielding high impact on confidentiality, integrity, and avai...

CVE-2025-27577

CVE-2025-27577 affects OpenHarmony v5.0.3 and earlier where a local attacker can achieve arbitrary code execution via a race condition in the tcb component. The root cause is a race condition that could be exploited locally; no remote vector is described in the provided documents. A remediation i...

CVE-2025-27562

CVE-2025-27562 affects OpenHarmony v5.0.3 and earlier. The vulnerability is a local DoS caused by a missing release of memory (memory leak) in the communication_dsoftbus component, enabling a local attacker to exhaust memory. Impact is described as availability loss (DoS); CVSS metrics indicate L...

CVE-2025-24925

OpenHarmony OpenHarmony OS v5.0.3 and earlier are affected by a local DoS due to a missing release of memory. The root cause is memory not being freed, leading to denial of service when exploited locally. Affected component/details consistently point to a memory-release issue; the publicly availa...

CVE-2025-27536

OpenHarmony CVE-2025-27536 affects v5.0.3 and earlier, with a type-confusion vulnerability in arkcompiler_ets_runtime that enables a local attacker to cause a DoS. Impact is denial of service (local access, low privileges) per linked records; recommended remediation is to upgrade to OpenHarmony 5...

CVE-2025-25277

OpenHarmony CVE-2025-25277 describes a local code execution vulnerability in OpenHarmony v5.1.0 and earlier, caused by a type confusion in arkcompiler_ets_runtime that can be triggered by using an incompatible type in pre-installed apps. Affected components are not enumerated beyond the arkcompil...