A permission control flaw in the HarmonyOS HDC module can allow an attacker to bypass service access restrictions and read protected data. The vulnerability is tied to permission handling, so once exploited, unauthorized users could gain confidential information. The impact is limited to confidentiality loss, with no evidence of code execution or denial of service.

Huawei HarmonyOS version 6.0.0 on devices listed in the 2026‑02 consumer support bulletin, including smartphones, laptops, and wearables.

The CVSS score of 6.3 indicates moderate severity, yet the EPSS value of less than 1% shows a very low probability of exploitation. The flaw is not present in the CISA Known Exploited Vulnerabilities catalog, suggesting limited current use. The likely attack scenario involves local privilege escalation on the device, exploiting the incorrect permission checks within the HDC module to read protected services. Remote exploitation is not documented.