Technical impact
A race condition flaw exists within the permission management service of HarmonyOS, allowing an attacker to manipulate concurrent access patterns. Successful exploitation may lead to a denial of service by causing the service to crash or become unresponsive, thereby impacting system availability. The vulnerability is associated with CWE‑362, which denotes a concurrency‑related flaw.
Affected Systems
The flaw affects Huawei HarmonyOS version 6.0.0. No other vendors or versions are listed in the public advisory. Devices running this operating system version are potentially exposed to the issue.
Risk and Exploitability
The CVSS score of 6.6 indicates moderate severity, while the EPSS score of less than 1% shows that known attacks are currently rare. HarmonyOS is not listed in CISA’s KEV catalog, suggesting no publicly reported exploitation has been documented. The attack vector is inferred to require an attacker with some level of local or privileged access due to the involvement of the system’s permission service. Considering the low current exploitation probability, the risk is moderate but the impact on availability warrants prompt remediation.
