Technical impact
This vulnerability is a race condition located in the HarmonyOS thermal management module. When concurrent requests to the module occur, the order in which the code executes is not guaranteed, which can corrupt internal state and lead to unintended termination of services or the system itself. The primary consequence is a lack of availability for the affected device or application, as the malfunction can cause crashes or forced restarts. The weakness is classified as CWE-362, indicating a race condition.
Affected Systems
Huawei HarmonyOS. No specific versions are listed in the advisory, so all devices running HarmonyOS that include the vulnerable thermal management component may be affected.
Risk and Exploitability
The CVSS base score of 6.3 indicates a moderate to high risk. No EPSS data is available, and the vulnerability is not currently present in the CISA KEV catalog. The attack vector is not explicitly documented; based on the description, it is inferred that the race condition could be triggered by concurrent operations initiated by an application or the system itself. If an attacker can invoke competing thermal management calls—either through a malicious app or by manipulating system processes—they may exploit the condition to destabilize the OS, impacting system availability. Because no exploit has been reported yet, the likelihood of active exploitation is unknown, but the potential impact warrants immediate attention.
