CVE-2025-20091 in OpenHarmony

Résumé

par MITRE • 04/03/2025

in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsable: OpenHarmony
• Réserver: 20/01/2025
• Divulgation: 04/03/2025
• Modérer: accepté
• Entrée: VDB-298446
• CPE: prêt
• CWE: CWE-416 (confirmé)
• CVSS: 3.8 (CNA)
• EPSS: 0.00164
• KEV: non
• Activités: très faible
• Secteur: Police, Lawfirm, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-20091
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-20091
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-20091/