The vulnerability in OpenHarmony v5.0.3 and earlier arises from insecure storage of sensitive information due to an uninitialized resource, allowing a local attacker to read confidential data. This weakness is categorized as CWE-908, signaling improper handling of sensitive data. The impact is the exposure of sensitive information to any user or process with local access, potentially compromising confidentiality. No evidence of remote exploitation or denial of service is provided. The likely attack vector is local.

OpenHarmony v5.0.3 and prior versions are affected. The CPE entry indicates openatom:openharmony:5.0.3.*; thus any release up to and including 5.0.3 may contain the flaw. Users running these versions should confirm whether their installation includes the uninitialized resource that leaks data. The specific affected components are not enumerated beyond the OpenHarmony operating system itself.

The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1% signifies a very low overall probability of exploitation at the system level. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the device; a remote attacker cannot trigger the data leak based on the provided information. Because it relies on local privileges, mitigations that restrict local users or enforce strict access controls reduce risk.