Huawei vulnerabilities and threats

CVE-2026-49304 is a permission control vulnerability in the device key management module of Huawei HarmonyOS version 6.1.0. Exploiting this flaw may impact system availability. The vulnerability has a CVSS score of 6.2, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.

Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-49307 is a permission control vulnerability in the multi-mode input module of Huawei HarmonyOS version 6.1.0. Successful exploitation can lead to unauthorized exposure of sensitive information, impacting service confidentiality. The vulnerability has a CVSS score of 6.2, indicating a medium severity level. There is no public information about available patches or official remediation. No known exploits are reported in the wild.

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.

Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-41982 is a race condition vulnerability in the IPC module of Huawei HarmonyOS. It involves a use-after-free issue (CWE-416) that can impact system availability if successfully exploited. The vulnerability affects versions 5.1.0, 6.0.0, and 6.1.0 of HarmonyOS. The CVSS v3.1 base score is 6.4, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-41981 is a heap-based buffer overflow vulnerability in the IPC module of Huawei HarmonyOS. Successful exploitation may impact system availability. The vulnerability affects versions 5.1.0, 6.0.0, and 6.1.0 of HarmonyOS. It has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-41977 is a medium severity denial-of-service (DoS) vulnerability in the log service of Huawei HarmonyOS. It is caused by an integer overflow or wraparound (CWE-190). Successful exploitation may impact system availability. The vulnerability affects multiple HarmonyOS versions including 4.0.0, 4.2.0, 4.3.0, and 4.3.1. No patch or official remediation guidance is currently available.

CVE-2026-41976 is a permission control vulnerability in the audio framework of Huawei HarmonyOS versions 4.3.0 and 4.3.1. Exploiting this vulnerability may lead to unauthorized access affecting the confidentiality of services. The vulnerability has a CVSS score of 6.6, indicating a medium severity level. No official patch or remediation guidance has been provided yet by the vendor.