A flaw in the HarmonyOS scanning module allows an attacker to trigger an uninitialized pointer access, which can lead to memory corruption and crash the device. The vulnerability is classified as CWE-824, indicating a use‑after‑free or pointer misuse scenario that threatens the system’s availability by potentially causing a denial of service. The CVE description explicitly states that successful exploitation may affect availability, underscoring the operational impact.

The affected product is Huawei’s HarmonyOS operating system, specifically version 6.0.0 as indicated by the CPE string. No additional affected releases are listed, so it is prudent to assume that later HarmonyOS iterations could also be vulnerable if they incorporate the same scanning module code without rectification.

The CVSS score of 6.8 reflects moderate severity. The EPSS score under 1% indicates a very low probability that the vulnerability will be actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited real‑world exploitation. Based on the description, it is inferred that the attack vector is local; an attacker would need to invoke the scanning module, perhaps via user interaction or a local process, to trigger the uninitialized pointer access. There is no evidence in the data of a remote exploitation path. The impact remains a crash or reboot that impairs availability, with no known privilege escalation or confidentiality breach.