A buffer overread flaw exists in the HarmonyOS HDC module, which can enable an attacker to read adjacent memory. Successful exploitation may expose private data and cause application instability or system crashes, leading to loss of confidentiality and availability.

The vulnerability affects Huawei HarmonyOS operating systems, specifically the 6.0.0 build found on phones, tablets, laptops, and wearable devices as listed by Huawei’s consumer support bulletins for February 2026.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% points to a low likelihood of widespread exploitation. The vulnerability is not listed in the KEV catalog, and no official workaround is available. Based on the description, the attack vector is likely local to the device, requiring interaction with the HDC module. The combination of moderate CVSS and very low EPSS suggests that while the potential impact is significant, the probability of real-world exploitation remains minimal at present.