Huawei vulnerabilities and threats

Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.

Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.

Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2026-34864 is a medium severity vulnerability in Huawei HarmonyOS version 6.0.0 involving improper restriction of operations within memory buffer bounds in the application read module. Exploitation of this boundary-unlimited vulnerability may impact system availability. There is no current information on an official patch or remediation. No known exploits are reported in the wild at this time.

CVE-2026-34863 is an out-of-bounds write vulnerability in the file system component of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Successful exploitation may impact system availability. The vulnerability has a CVSS 3.1 base score of 6.7, indicating a medium severity level. There is no vendor-provided patch or official remediation guidance available at this time.

CVE-2026-34862 is a race condition vulnerability in the power consumption statistics module of Huawei HarmonyOS version 6.0.0. Exploiting this flaw may impact system availability. The vulnerability is classified under CWE-362, indicating improper synchronization during concurrent execution using shared resources. The CVSS score is 6.3, reflecting a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-34861 is a race condition vulnerability in the thermal management module of Huawei HarmonyOS version 6.0.0. This flaw involves improper synchronization during concurrent execution using shared resources. Exploiting this vulnerability may impact system availability. The CVSS score is 6.3, indicating a medium severity level. No official patch or remediation guidance has been provided by Huawei as of the publication date. There are no known exploits in the wild currently.

CVE-2026-34859 is a use-after-free vulnerability in the kernel module of Huawei HarmonyOS versions 4.2.0 and 4.3.0. Exploiting this vulnerability could impact system availability and confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.9. There is no information currently available about patches or official remediation. No known exploits are reported in the wild at this time.

CVE-2026-34858 is a use-after-free (UAF) vulnerability in the communication module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. It is caused by a race condition due to improper synchronization when accessing shared resources. Successful exploitation may impact system availability but does not affect confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 4.1, indicating medium severity.

CVE-2026-34857 is a use-after-free (UAF) vulnerability in the communication module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. It is caused by improper synchronization leading to a race condition (CWE-362). Successful exploitation may impact system availability. The vulnerability has a CVSS 3.1 base score of 4.7, indicating medium severity.

CVE-2026-34855 is an out-of-bounds write vulnerability in the kernel module of Huawei HarmonyOS affecting multiple versions from 4.0.0 to 6.0.0. Exploitation can impact system availability and confidentiality. The vulnerability is due to improper input validation (CWE-20). It has a CVSS 3.1 base score of 5.7, indicating medium severity.

CVE-2026-34854 is a use-after-free (UAF) vulnerability in the kernel module of Huawei HarmonyOS affecting multiple versions from 4.0.0 through 6.0.0. Successful exploitation impacts system availability and confidentiality. The vulnerability has a medium severity with a CVSS score of 5.7. No official patch or remediation guidance has been provided by the vendor at this time. There are no known exploits in the wild currently.

CVE-2026-34849 is a use-after-free (UAF) vulnerability in the screen management module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. It is classified as a race condition (CWE-362) caused by improper synchronization during concurrent execution using shared resources. The vulnerability may impact system availability if successfully exploited. The CVSS v3.1 base score is 2.5, indicating low severity.

CVE-2026-34856 is a use-after-free (UAF) vulnerability in the communication module of Huawei HarmonyOS version 6.0.0. It is caused by a race condition due to improper synchronization when accessing shared resources. Exploitation of this vulnerability may impact system availability. The vulnerability has a high severity rating with a CVSS score of 7.3. No official patch or remediation guidance has been provided by the vendor at this time. There are no known exploits in the wild currently.

CVE-2026-34853 is a high-severity permission bypass vulnerability in the Location-Based Services (LBS) module of Huawei HarmonyOS versions 4.0.0 through 4.3.1. It involves a privilege context switching error (CWE-270) that may allow an attacker with high privileges and user interaction to bypass permissions, potentially impacting system availability. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant risk. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-28553 is a medium severity vulnerability in Huawei HarmonyOS versions 4.0.0 through 4.3.1 involving improper permission control in the theme setting module. Exploitation could lead to a confidentiality breach of services. The vulnerability requires local access with high attack complexity and user interaction, and it impacts confidentiality, integrity, and availability to varying degrees. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-34867 is a double free vulnerability in the multi-mode input system of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Successful exploitation may impact system availability by causing a denial of service. The vulnerability has a medium severity with a CVSS score of 5.6. There is no information about an available patch or official remediation from the vendor. No known exploits are reported in the wild at this time.

CVE-2026-34860 is an access control vulnerability in the memo module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Successful exploitation can lead to impacts on system availability and confidentiality. The vulnerability has a medium severity with a CVSS score of 4.1. There is no information currently available about patches or official remediation. No known exploits in the wild have been reported.