The vulnerability stems from improper verification in Huawei's email application, resulting in a potential confidentiality breach. An attacker that succeeds at exploiting this flaw could read or exfiltrate email content or possibly gain unauthorized access to data stored in the application. The flaw is identified as CWE‑269, an improper privilege management weakness that may allow privileged operations to be performed without the expected checks.

Affected are Huawei devices running EMUI 12.0.0 through 14.2.0, as well as HarmonyOS 2.0.0 through 4.2.0, according to the list of affected CPEs. These include all commercial smartphones, tablets, and other consumer devices that ship with the specified OS versions.

The CVSS score of 7.1 indicates a moderate to high severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation by threat actors at this time. Huawei has not listed the vulnerability in the CISA KEV catalog, implying that no widespread exploitation has been reported. Attackers would need to trigger the email verification flaw, likely from a malicious email or via a local compromise of the device, to read confidential data, so the risk is limited to users who use the affected email application.