The vulnerability arises from improper input validation in the filemanagement_storage_service component of OpenHarmony. A local attacker can supply malformed input that causes the service to crash or become unresponsive, resulting in a denial of service for users of the affected device. The weakness corresponds to CWE‑20 and demonstrates how inadequate input checks can destabilize critical system components.

OpenHarmony operating system version 6.0 and earlier are impacted. The vulnerability is present in the filemanagement_storage_service module that is part of the core OS. Users operating these releases on devices that allow local code execution or local user account privileges may be affected.

The CVSS v3.1 base score is 3.3, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation risk is moderate. Because the attack requires local privileges and the impact is a denial of service, administrators should consider it a low‑to‑moderate risk that can disrupt normal operation if a compromised local user exists.