A boundary-unlimited flaw exists in HarmonyOS’s application read module, allowing an attacker to supply input that exceeds expected limits. The weakness can trigger uncontrolled memory reads or writes, which may destabilize the application or the operating system, leading to crashes or forced restarts. This vulnerability is classified as CWE-119 and primarily carries availability implications rather than compromising confidentiality or integrity.

The vendor affected is Huawei, specifically its HarmonyOS operating system. No specific release numbers are mentioned, implying that all current HarmonyOS builds could be vulnerable until a vendor patch is applied.

The CVSS score of 6.8 indicates moderate severity. Because EPSS data is missing and the flaw is not listed in CISA’s KEV catalog, no widespread exploitation has been reported. Based on the description, the attack likely requires input directed at the vulnerable read module, which could be delivered locally or remotely depending on the exposed interfaces. Successful exploitation would result in application or system outages but is not believed to allow code execution or data disclosure.