PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25850 OpenHarmony CVE debrief

A local information disclosure vulnerability exists in OpenHarmony v6.0 and prior versions. The flaw allows a local attacker to cause information leakage. The vulnerability is classified as CWE-281 (Improper Preservation of Permissions) and carries a CVSS 3.1 score of 5.5 (MEDIUM severity). The attack vector is local with low attack complexity, requiring low privileges but no user interaction. The confidentiality impact is rated HIGH while integrity and availability impacts are NONE. The CVE was published on 2026-05-19 and subsequently modified the same day. The vulnerability status in NVD is currently 'Deferred'. OpenHarmony has published a security disclosure for May 2026 that contains additional details. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
OpenHarmony
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Organizations running OpenHarmony v6.0 or earlier in production environments, particularly those with multi-user scenarios or concerns about local privilege boundaries. System administrators managing OpenHarmony deployments and security teams tracking mobile/IoT operating system vulnerabilities.

Technical summary

The vulnerability exists in OpenHarmony v6.0 and prior versions due to improper preservation of permissions (CWE-281). A local attacker with low privileges can exploit this flaw to cause information leakage. The attack requires local access and low privileges but no user interaction. The high confidentiality impact indicates sensitive information may be exposed to unauthorized local users. The vulnerability does not affect integrity or availability.

Defensive priority

medium

Recommended defensive actions

  • Review OpenHarmony security disclosure for May 2026 to obtain detailed technical information about affected components and patches
  • Assess local access controls on OpenHarmony deployments to limit exposure to authenticated users
  • Monitor OpenHarmony security advisories for patch availability and apply updates when released
  • Review permission preservation mechanisms in custom OpenHarmony builds for similar weaknesses
  • Audit systems for unauthorized local access that could facilitate information disclosure attacks

Evidence notes

Vulnerability confirmed through official NVD record with CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. CWE-281 (Improper Preservation of Permissions) identified as the weakness type. Source reference from OpenHarmony security disclosure repository on Gitcode.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25850 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25850

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25850 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25850

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.