CWE-275 vulnerabilities

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-41976 is a permission control vulnerability in the audio framework of Huawei HarmonyOS versions 4.3.0 and 4.3.1. Exploiting this vulnerability may lead to unauthorized access affecting the confidentiality of services. The vulnerability has a CVSS score of 6.6, indicating a medium severity level. No official patch or remediation guidance has been provided yet by the vendor.

Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-28553 is a medium severity vulnerability in Huawei HarmonyOS versions 4.0.0 through 4.3.1 involving improper permission control in the theme setting module. Exploitation could lead to a confidentiality breach of services. The vulnerability requires local access with high attack complexity and user interaction, and it impacts confidentiality, integrity, and availability to varying degrees. No official patch or remediation guidance is currently available from the vendor.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.

Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may allow the peer device to use the camera without user awareness.