Out-of-bounds read vulnerability in the image codec module of HarmonyOS allows an attacker to read beyond intended memory bounds. This could expose sensitive data stored in the device's memory, thereby compromising service confidentiality. The weakness is a classic buffer overflow scenario, classified as CWE-120.

The affected product is Huawei HarmonyOS. No specific version information is available in the current advisory.

The CVSS score of 4.0 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector involves supplying maliciously crafted image files to the vulnerable codec component, likely requiring local or remote access to the device's image processing workflow.