The vulnerability is an out‑of‑bounds read located in the peripheral module of Huawei HarmonyOS. An attacker who can trigger the flaw can read data from memory outside the intended bounds, resulting in disclosure of internal data and a violation of service confidentiality. The weakness is identified as CWE‑805 and does not provide remote code execution or denial of service, but it does compromise the integrity of confidential information held by the service.

Huawei HarmonyOS is affected. No specific version information is provided, so all current releases of HarmonyOS should be considered potentially vulnerable until a patch is released.

The CVSS base score of 5.9 places the issue in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. The flaw is likely exploitable from within the local device context or via privileged access to the peripheral module; an attacker would need to interact with the vulnerable component to trigger the read. Consequently, risk is moderate, primarily affecting confidentiality of the service data.