PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28751 OpenHarmony CVE debrief

A local denial-of-service (DoS) vulnerability exists in OpenHarmony v6.0 and prior versions. The vulnerability allows a local attacker to cause a DoS condition. The issue was disclosed on 19 May 2026 and is classified as low severity with a CVSS 3.1 score of 3.3. The vulnerability is associated with CWE-20 (Improper Input Validation). The NVD entry status is currently 'Deferred'.

Vendor
OpenHarmony
Product
Unknown
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Organizations running OpenHarmony v6.0 or earlier in production environments, particularly those with multi-user scenarios where local access cannot be fully restricted. System administrators responsible for OpenHarmony device fleet security should monitor for patch availability.

Technical summary

CVE-2026-28751 is a local denial-of-service vulnerability in OpenHarmony v6.0 and earlier. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates a local attack with low complexity and privilege requirements, affecting availability only. The root cause is categorized as CWE-20 (Improper Input Validation). The vulnerability was disclosed on 19 May 2026 via official OpenHarmony security channels. NVD status is currently 'Deferred', indicating the entry may be awaiting additional analysis or vendor confirmation.

Defensive priority

low

Recommended defensive actions

  • Review OpenHarmony security disclosure documentation for affected component details and patch availability
  • Assess local access controls on OpenHarmony deployments to limit exposure
  • Monitor OpenHarmony security advisories for updated patch status
  • Apply security updates when released by OpenHarmony maintainers

Evidence notes

The vulnerability description indicates local attack vector (AV:L) with low attack complexity (AC:L) and low privileges required (PR:L), resulting in low availability impact (A:L). The official OpenHarmony security disclosure reference provides authoritative source documentation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28751 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28751

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28751 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28751

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.