openharmony vulnerabilities and fixes

Recent CVEs affecting openharmony, with upgrade or downgrade steps. 93 tracked.

openharmony has 93 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 85. Most recent: 2026-03-16. Highest priority: CVE-2024-41157 (score 33/100).

• CVE-2026-0639 LOW 3.3 UPGRADE in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-6969 MEDIUM 5.0 MITIGATE in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.
• CVE-2025-52458 MEDIUM 5.5 MITIGATE in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-41432 MEDIUM 5.5 MITIGATE in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-27577 HIGH 8.4 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race c
• CVE-2025-27563 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
• CVE-2025-27562 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-27536 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.
• CVE-2025-27534 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-27248 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
• CVE-2025-27247 MEDIUM 5.5 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
• CVE-2025-27242 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.
• CVE-2025-27241 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
• CVE-2025-27132 LOW 3.8 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-27131 MEDIUM 6.1 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.
• CVE-2025-27128 HIGH 8.4 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use af
• CVE-2025-26693 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
• CVE-2025-26691 MEDIUM 5.5 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
• CVE-2025-26690 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
• CVE-2025-26474 LOW 3.3 MITIGATE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input
• CVE-2025-25278 HIGH 8.4 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race c
• CVE-2025-25277 MEDIUM 6.3 MITIGATE in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-25218 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
• CVE-2025-25217 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
• CVE-2025-25212 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input.
• CVE-2025-25057 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-25052 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.
• CVE-2025-24925 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-24844 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-24493 MEDIUM 5.5 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition.
• CVE-2025-24309 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-24304 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds write.
• CVE-2025-24301 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-24298 HIGH 8.4 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use af
• CVE-2025-23420 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-23418 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-23414 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-23409 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-23240 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-23235 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-23234 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
• CVE-2025-22897 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
• CVE-2025-22886 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-22851 MEDIUM 6.5 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-22847 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-22842 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-22841 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-22837 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
• CVE-2025-22835 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-22452 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-22443 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-21098 MEDIUM 5.5 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds r
• CVE-2025-21097 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
• CVE-2025-21089 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-21084 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-21082 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion.
• CVE-2025-20626 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-20102 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-20091 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-20081 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-20063 LOW 3.3 UPGRADE in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion.
• CVE-2025-20042 MEDIUM 5.5 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds r
• CVE-2025-20024 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-20021 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2025-20011 LOW 3.3 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
• CVE-2025-12736 MEDIUM 6.5 MITIGATE in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of
• CVE-2025-0587 LOW 3.8 UPGRADE in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2025-0304 HIGH 8.8 UPGRADE in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2025-0303 HIGH 8.8 UPGRADE in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2025-0302 MEDIUM 5.5 UPGRADE in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow.
• CVE-2024-9978 MEDIUM 5.5 UPGRADE in OpenHarmony v4.1.1 and prior versions allow a local attacker cause information leak through out-of-bounds R
• CVE-2024-54030 MEDIUM 4.4 UPGRADE in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.
• CVE-2024-47797 HIGH 8.4 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2024-47404 HIGH 8.4 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2024-47402 LOW 3.3 UPGRADE in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through out-of-bounds read.
• CVE-2024-47398 HIGH 8.8 UPGRADE in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through
• CVE-2024-47137 HIGH 8.4 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2024-45382 LOW 3.3 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write.
• CVE-2024-45070 MEDIUM 5.5 UPGRADE in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds R
• CVE-2024-43697 LOW 3.3 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input.
• CVE-2024-43696 LOW 3.3 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak.
• CVE-2024-41160 HIGH 8.8 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2024-41157 HIGH 8.8 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to roo
• CVE-2024-39831 MEDIUM 4.4 UPGRADE in OpenHarmony v4.1.0 allow a local attacker with high privileges arbitrary code execution in pre-installed ap
• CVE-2024-39816 HIGH 8.4 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2024-39806 MEDIUM 5.5 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds R
• CVE-2024-39775 MEDIUM 6.5 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds
• CVE-2024-39612 MEDIUM 5.5 MITIGATE in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds R
• CVE-2024-38386 HIGH 8.4 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps
• CVE-2024-38382 MEDIUM 5.5 MITIGATE in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds R
• CVE-2024-28044 LOW 3.3 UPGRADE in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow.
• CVE-2024-12082 MEDIUM 5.5 UPGRADE in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds R
• CVE-2024-10074 HIGH 8.8 UPGRADE in OpenHarmony v4.1.1 and prior versions allow a local attacker cause the common permission is upgraded to roo

FAQ

How do I fix openharmony vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is openharmony being exploited right now?

None of the tracked openharmony CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which openharmony CVE should I patch first?

CVE-2024-41157 currently ranks highest (33/100): in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to roo.

RSS feed for openharmony · ← Back to latest CVEs