Technical impact
A use‑after‑free vulnerability exists in the security module of Huawei EMUI and HarmonyOS. The flaw exposes memory after it has been freed, allowing an attacker to manipulate the application or system state once the compromised memory is reused. The consequence is primarily an availability impact, where privileged functions could be disturbed or the system could become unstable or crash. The weakness is identified as CWE-416.
Affected Systems
Affected vendors and products include Huawei EMUI versions 13.0.0, 14.0.0, 14.2.0 and 15.0.0, as well as Huawei HarmonyOS versions 3.1.0, 4.0.0, 4.2.0 and 4.3.0. These are the devices for which the lack of the security module fix is documented.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, and the EPSS score is less than 1%, suggesting that exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog, which reduces the likelihood of publicly known attacks. Given that the flaw lies in a system‑level security module, the attack vector is likely local device exploitation with privileged access, although if the module is exposed via remote interfaces it could potentially be triggered from outside. The exploit would require manipulating memory allocations or forcing the module to dereference freed pointers, which in turn could lead to corruption or crashes.
