In OpenHarmony versions 5.1.0 and earlier, the ability runtime component fails to properly validate input, allowing a local attacker to trigger a denial‑of‑service condition. This flaw is rooted in CWE‑20 (Improper Input Validation) and can cause the system or specific services to become unresponsive when malformed data is processed. The impact is confined to the local machine, where the attacker can disrupt availability of the operating system or critical applications.

Affected products are OpenHarmony (OpenAtom) versions 5.0.3 and 5.1.0 (and any prior releases). The CNA identifies these as vulnerable, with the bug present in both tagged releases.

The CVSS score of 5 denotes moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability has not been reported in CISA’s KEV catalog and appears to be exploitable only by an attacker with local access. Consequently, the overall risk is moderate, but the likelihood of real‑world exploitation remains low.