CVE-2026-24921
Published: 06 February 2026
Summary
CVE-2026-24921 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Huawei Harmonyos. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read enables local memory disclosure (T1005 Data from Local System) and application/system crash for DoS (T1499.004 Application or System Exploitation); PR:H and UI:R limit direct applicability to escalation or remote techniques.
NVD Description
Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Deeper analysisAI
CVE-2026-24921 is an address read vulnerability in the HDC module, corresponding to CWE-125 (Out-of-bounds Read). It affects Huawei consumer products, including laptops and wearables, as indicated by the vendor's security bulletins. The vulnerability was published on 2026-02-06T09:15:50.583 and carries a CVSS v3.1 base score of 4.8 (AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H), reflecting medium severity with impacts on confidentiality and availability.
Exploitation requires local access to the affected system, low attack complexity, high privileges (PR:H), and user interaction (UI:R), with no scope change. A successful attack can result in low-impact disclosure of confidential information alongside high-impact disruption to availability, such as denial of service.
Huawei has published security bulletins addressing this vulnerability, available at https://consumer.huawei.com/en/support/bulletin/2026/2/, https://consumer.huawei.com/en/support/bulletinlaptops/2026/2/, and https://consumer.huawei.com/en/support/bulletinwearables/2026/2/, which likely detail patches or mitigations for affected consumer products, laptops, and wearables.
Details
- CWE(s)