Description
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
Published: 2026-06-09
Score: 5.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a use‑after‑free flaw in the package management module of Huawei HarmonyOS. The flaw can lead to compromised service integrity, potentially causing the affected services to crash or behave unpredictably. The weakness is classified as CWE‑284, indicating an access control issue that allows improper handling of memory resources during package operations.

Affected Systems

The affected system is Huawei HarmonyOS. No specific affected versions are listed in the available CNA data.

Risk and Exploitability

The CVSS score of 5.2 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unclear. The vulnerability is not included in CISA’s KEV catalog. Remaining inference suggests the attack vector may be local, arising during package installation or removal, but the precise conditions are not explicitly stated in the advisory.

Generated by OpenCVE AI on June 9, 2026 at 08:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest HarmonyOS update released by Huawei that addresses the package‑management use‑after‑free flaw, as referenced in their support bulletin.
  • Limit package installation privileges to trusted administrators and audit all installation attempts to prevent unauthorized manipulation of the package‑management module.
  • Monitor system logs and integrity checks for abnormal activities related to package handling and memory deallocation, and trigger alerts if suspicious events occur.

Generated by OpenCVE AI on June 9, 2026 at 08:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 09 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Huawei
Huawei harmonyos
Vendors & Products Huawei
Huawei harmonyos

Tue, 09 Jun 2026 07:45:00 +0000

Type Values Removed Values Added
Description UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Huawei Harmonyos
cve-icon MITRE

Status: PUBLISHED

Assigner: huawei

Published:

Updated: 2026-06-09T13:02:13.804Z

Reserved: 2026-04-23T01:42:44.930Z

Link: CVE-2026-41984

cve-icon Vulnrichment

Updated: 2026-06-09T13:01:57.259Z

cve-icon NVD

Status : Deferred

Published: 2026-06-09T08:16:28.413

Modified: 2026-06-09T13:34:58.997

Link: CVE-2026-41984

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-09T09:30:35Z

Weaknesses