A double‑free defect has been found in Huawei HarmonyOS’s multi‑mode input system. The flaw enables a crafted input to trigger a second deallocation of memory that was already freed, leading to undefined behavior that typically results in an application crash or a system reset. This causes loss of service rather than exposure or modification of data, and the weakness aligns with CWE‑415, describing improper memory management.

The vulnerability affects devices running Huawei HarmonyOS. No explicit version information is provided in the advisory, so system administrators should reference Huawei’s support bulletin dated April 2026 to determine if their installation requires an update.

With a CVSS score of 5.6 the issue is considered moderate in severity. Because no EPSS data is available and the bug is not listed in CISA’s KEV catalog, it is unlikely to be actively exploited at this time. The description does not specify an attack vector; therefore, it is inferred that an attacker would need to deliver malicious input to the vulnerable subsystem, probably through local or privileged access to the device. The risk is thus modest, pending the availability of an exploit.