Huawei’s EMUI and HarmonyOS contain a permission control flaw in their projection module. The flaw allows an attacker to bypass access checks when invoking the projection service, potentially exposing data that the module is meant to protect. The weakness is classified as CWE‑275, indicating unauthorized information disclosure.

Both Huawei EMUI and Huawei HarmonyOS are affected. The advisory does not specify a vulnerable version range, implying that any release incorporating the projection component without the fix is potentially at risk until a firmware or software update is applied.

The CVSS base score of 6.2 represents moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. EPSS data is unavailable, leaving exploitation likelihood unclear. The attack vector is not explicitly detailed, but the flaw would require the attacker to trigger the projection feature—likely through local access or an exposed network interface. Successful exploitation could lead to unauthorized reading of protected data, resulting in a confidentiality breach.