In OpenHarmony v6.0 and earlier, the system fails to release allocated memory under specific conditions, leading to a memory leak. This flaw, catalogued as CWE‑401, permits a local attacker to repeatedly trigger the leak, consuming system memory until processes become unresponsive, resulting in a denial of service. The vulnerability does not disclose data or allow code execution; its impact is confined to availability.

The vulnerability affects all releases of OpenHarmony version 6.0 and any prior versions, as identified by the vendor identifiers OpenHarmony:OpenHarmony and the CPE string cpe:2.3:o:openatom:openharmony:*:*:*:*:-:*:*:*.

The CVSS score is 3.3, indicating low severity, while the EPSS score is below 1%, showing a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local—an attacker must have local access to initiate the memory‑consuming operations. Because the flaw only causes a service interruption, the overall risk to confidentiality and integrity is none.