Huawei vulnerabilities
We track 270 vulnerabilities in Huawei products across 60+ products. 270 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 2, 2026.
Latest Huawei vulnerabilities
- 7.1 High severity
HarmonyOS: Deserialization of Untrusted Data
Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.1 High severity
HarmonyOS: Use After Free
Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vulnerability will affect integrity and availability.
- 7.8 High severity
CurieM-WFG9B: Improper Access Control
Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak an
- 7.8 High severity
CurieM-WFG9B: Missing Release of Memory after Effective Lifetime
Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak an
- 7.8 High severity
CurieM-WFG9B: Improper Check for Unusual or Exceptional Conditions
Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26), As the communication buffer size hasn’t been properly validated to be of the expected size, it can partially overlap with the beginning SMRAM.This can be leveraged by a malicious OS attacker to corrupt data s
- 7.8 High severity
CurieM-WFG9B: Out-of-bounds Write
Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26) Arbitrary Memory Corruption in SMI Handler of ThisiServicesSmm SMM module. This can be leveraged by a malicious OS attacker to corrupt arbitrary SMRAM memory and, in turn, lead to code execution in SMM
- 7.8 High severity
CurieM-WFG9B: Out-of-bounds Write
Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26. Memory Corruption in SMI Handler of HddPassword SMM Module. This can be leveraged by a malicious OS attacker to corrupt data structures stored at the beginning of SMRAM and can potentially lead to code executi
- 7.5 High severity
Permission verification vulnerability in the system sharing pop-up module Impact: Successful…
Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful…
Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Buffer Copy without Checking Size of Input
Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Buffer Copy without Checking Size of Input
Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
Vulnerability of package name verification being bypassed in the Calendar app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Missing Authorization
Authentication vulnerability in the API for app pre-loading. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Authorization
Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 9.1 Critical severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Insufficient Permissions or Privileges
Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Authorization
Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Insufficient Permissions or Privileges
Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in the Bluetooth-based sharing module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Violation of Secure Design Principles
Vulnerability of defects introduced in the design process in the hwnff module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.7 High severity
HarmonyOS: Missing Authorization
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
- 9.1 Critical severity
HarmonyOS: Incorrect Default Permissions
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.5 High severity
HarmonyOS: Improper Neutralization of Special Elements used in an OS Command
Command injection vulnerability in the AccountManager module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 9.8 Critical severity
HarmonyOS: Improper Control of Generation of Code
Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
- 9.8 Critical severity
HarmonyOS: Protection Mechanism Failure
Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.4 High severity
HarmonyOS: Out-of-bounds Read
Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access.
- 7.5 High severity
HarmonyOS: Improper Preservation of Permissions
Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.
- 7.7 High severity
HarmonyOS: Improper Access Control
Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrity.
- 7.5 High severity
HarmonyOS: Buffer Copy without Checking Size of Input
Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Deserialization of Untrusted Data
Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidentiality.
- 9.1 Critical severity
Vulnerability of permission verification for APIs in the DownloadProviderMain module.
Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability will affect integrity and availability.
- 7.5 High severity
HarmonyOS: Improper Access Control
Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.