OpenHarmony's arkcompiler Ets runtime contains an out‑of‑bounds write that can be triggered by a local attacker, ultimately enabling arbitrary code execution within pre‑installed applications. The vulnerability is a classic buffer overflow flaw (CWE‑787) and allows the attacker to overwrite memory and run malicious code, potentially compromising system confidentiality, integrity, and availability.

The vulnerability affects OpenHarmony OS participants, specifically versions 5.0.3 and 5.1.0, as indicated by the CPE entries. Earlier releases may also be impacted, but only the listed versions are confirmed.

The CVSS score of 5.5 classifies the issue as medium severity. EPSS indicates a very low current exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker and is limited to restricted scenarios, as the description specifies that the out‑of‑bounds write can be exploited only in such contexts. The attack vector is therefore local; remote exploitation is not supported according to the available data.