This vulnerability (CVE-2026-41972) involves improper limitation of a pathname to a restricted directory (CWE-22) in the SMS application of Huawei HarmonyOS. It allows an attacker to perform path traversal, potentially affecting the availability of the system. The vulnerability affects HarmonyOS versions 5.1.0, 6.0.0, and 6.1.0. The CVSS 3.1 base score is 5.4, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No patch or official remediation level has been disclosed by Huawei as of the published date.

Successful exploitation may impact the availability of the affected device by leveraging path traversal in the SMS app. There is no impact on confidentiality and only a low impact on integrity. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, monitor Huawei's advisories for updates. Avoid opening suspicious SMS messages or links that could trigger the vulnerability until a patch is available.