Technical impact
This vulnerability is a use‑after‑free condition in the HarmonyOS communication module. Properly managing object lifetimes is violated, which allows an attacker to corrupt memory after the object has been freed. The failure can cause the system or an affected application to crash or restart, resulting in a loss of availability for the device or user.
Affected Systems
All Huawei HarmonyOS devices referenced in the consumer service bulletins published in April 2026 are affected. No specific device models or operating‑system versions were listed in the advisory, so all releases covered by that bulletin should be assumed vulnerable until a patch is applied.
Risk and Exploitability
The CVSS base score of 7.3 points to a high‑severity flaw. Exploitation requires an attacker to deliver specially crafted input that triggers the use‑after‑free; the specific transport mechanism is unspecified, but it is likely tied to network or inter‑process communication. No EPSS score is available and the vulnerability is not in CISA’s KEV catalog, which suggests it may not yet be widely exploited in the wild. Nevertheless, because the flaw can lead to a denial of service, the risk is significant to users who depend on continuous operation of the device.
