Description
Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.
Published: 2026-05-15
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An Use‑After‑Free flaw exists in HarmonyOS’s web engine, identified as CWE‑840, and can cause the engine to crash, leading to denial of service on the device as noted in the advisory.

Affected Systems

Devices running Huawei HarmonyOS are affected. No specific firmware or version numbers are listed, so the vulnerability is presumed to exist in current releases until a patch is provided. All HarmonyOS units with active web browsing capabilities are at risk.

Risk and Exploitability

The CVSS score of 5.6 indicates moderate impact, the EPSS score is not available, so the probability of exploitation is uncertain. The vulnerability is not listed in CISA KEV and no public exploits have been documented. The likely attack vector is via crafted web content delivered to the device, making it a remote DoS risk that may require the user to load the malicious page.

Generated by OpenCVE AI on May 15, 2026 at 11:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the firmware update released by Huawei that addresses the Use‑After‑Free bug.
  • If an update is not yet available, disable or restrict web browsing functionality on the device to prevent exploitation.
  • Continue monitoring Huawei security bulletins and apply future patches promptly.

Generated by OpenCVE AI on May 15, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 15 May 2026 11:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Vulnerability in HarmonyOS Web Engine May Cause Availability Issues
First Time appeared Huawei
Huawei harmonyos
Vendors & Products Huawei
Huawei harmonyos

Fri, 15 May 2026 11:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 15 May 2026 10:00:00 +0000

Type Values Removed Values Added
Description Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.
Weaknesses CWE-840
References
Metrics cvssV3_1

{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Huawei Harmonyos
cve-icon MITRE

Status: PUBLISHED

Assigner: huawei

Published:

Updated: 2026-05-15T11:03:52.460Z

Reserved: 2026-04-23T01:42:44.928Z

Link: CVE-2026-41965

cve-icon Vulnrichment

Updated: 2026-05-15T11:03:45.432Z

cve-icon NVD

Status : Deferred

Published: 2026-05-15T10:16:35.207

Modified: 2026-05-15T14:08:50.797

Link: CVE-2026-41965

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-15T11:30:43Z

Weaknesses