Technical impact
The vulnerability is an out-of-bounds character read in the Bluetooth subsystem of Huawei's HarmonyOS. Successfully exploited, it allows a nearby attacker to read memory content beyond boundaries, exposing potentially sensitive data. The weakness is categorized under CWE‑125 and CWE‑158 and does not provide code execution or denial of service, but it can compromise service confidentiality.
Affected Systems
Huawei HarmonyOS 5.1.0 and HarmonyOS 6.0.0 are affected across a range of consumer devices, including phones, laptops, vision devices, and wearables as referenced by Huawei's consumer support bulletins. The vulnerability centers on the Bluetooth implementation shipped with these operating‑system releases.
Risk and Exploitability
The CVSS score of 4 indicates medium risk, while the EPSS score of less than 1% suggests very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be within Bluetooth range of the target device, implying a local or proximity-based threat. Overall, the risk is low but the confidentiality impact warrants timely resolution.
