Vulnerabilities in OpenHarmony

177 results
Vexday analysis

Com 177 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o OpenHarmony apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de agentes maliciosos sobre suas vulnerabilidades. A ausência de CVEs de severidade crítica e de provas de conceito públicas reforça um perfil de risco contido no momento, embora 10 novas CVEs registradas nos últimos 90 dias indiquem atividade contínua de descoberta que merece acompanhamento. O tipo de falha mais frequente é CWE-416 (use-after-free), classe de vulnerabilidade que, por natureza, pode levar a execução de código arbitrário e elevação de privilégios, demandando atenção prioritária em revisões de código e processos de desenvolvimento. A CVE mais relevante no momento, CVE-2024-37185, apresenta EPSS de 0,0062, sinalizando baixa probabilidade de exploração iminente, mas ainda assim deve ser tratada como referência para priorização de mitigações.

CVE-2025-26474LOWcommunication_ipc an improper input validation vulnerabilityEPSS 0.1%CVE-2025-22847LOWArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.1%CVE-2025-21097LOWArkcompiler Ets Runtime has a NULL pointer dereference vulnerabilityEPSS 0.1%CVE-2025-23418LOWArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.1%CVE-2025-21089LOWArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.1%CVE-2025-20021LOWArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.1%CVE-2025-22443LOWArkcompiler Ets Runtime has an out-of-bounds read vulnerabilityEPSS 0.1%CVE-2024-22177LOWAudio has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2023-47216LOWLiteos-A has a missing release of resource vulnerabilityEPSS 0.1%CVE-2023-49602LOWArkui has a type confusion vulnerabilityEPSS 0.1%CVE-2025-27131MEDIUMkernel_liteos_m has an improper input vulnerabilityEPSS 0.1%CVE-2026-25781HIGHkernel_liteos_a has an out-of-bounds write vulnerabilityEPSS 0.1%CVE-2026-28733MEDIUMfilemanagement_storage_service has an use after free vulnerabilityEPSS 0.1%CVE-2025-25217LOWarkui_ace_enginehas a NULL pointer dereference vulnerabilityEPSS 0.1%CVE-2025-23235LOWarkcompiler_ets_runtime has an out-of-bounds write vulnerabilityEPSS 0.1%CVE-2025-21082LOWarkui_ace_engine has a type confusion vulnerabilityEPSS 0.1%CVE-2025-20063LOWarkui_ace_engine has a type confusion vulnerabilityEPSS 0.1%CVE-2025-27242LOWSsecurity_component_manager has an improper input vulnerabilityEPSS 0.1%CVE-2025-27247MEDIUMPasteboard has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2025-26691MEDIUMtelephony_call_manager has an improper preservation of permissions vulnerabilityEPSS 0.1%