Huawei vulnerabilities
We track 270 vulnerabilities in Huawei products across 60+ products. 270 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 2, 2026.
Latest Huawei vulnerabilities
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciously modified and overwritten.
- 7.5 High severity
Vulnerability of input parameters being not strictly verified in the PMS module.
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
- 7.5 High severity
Vulnerability of input parameters being not strictly verified in the PMS module.
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Exposure of Resource to Wrong Sphere
Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.
- 9.1 Critical severity
HarmonyOS: Buffer Copy without Checking Size of Input
Buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.
- 9.8 Critical severity
HarmonyOS: Authorization Bypass Through User-Controlled Key
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory (NVRAM), or facilitate the exploitation of other vulnerabilities.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
Vulnerability of missing input length verification in the distributed file system. Successful exploitation of this vulnerability may cause out-of-bounds read.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Exceptional Conditions
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Uncaught Exception
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect confidentiality.
- 9.8 Critical severity
HarmonyOS: Authentication Bypass by Spoofing
Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.
- 9.8 Critical severity
HarmonyOS: Use After Free
Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.
- 9.8 Critical severity
HarmonyOS: Use After Free
Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.
- 7.5 High severity
HarmonyOS: Authentication Bypass by Capture-replay
Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Uncontrolled Resource Consumption
Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5 High severity
HarmonyOS: Improper Authentication
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
- 7.5 High severity
HarmonyOS: Improper Authentication
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
- 7.5 High severity
BiSheng-WNM: Interpretation Conflict
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- 9.8 Critical severity
BiSheng-WNM: Improper Neutralization of Special Elements used in an OS Command
A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
- 7.5 High severity
BiSheng-WNM: Interpretation Conflict
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- 8.0 High severity
FLMG-10: Out-of-bounds Write
A Huawei sound box product has an out-of-bounds write vulnerability. Attackers can exploit this vulnerability to cause buffer overflow. Affected product versions include:FLMG-10 versions FLMG-10 10.0.1.0(H100SP22C00).
- 8.2 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.
- 7.5 High severity
HarmonyOS: Missing Authentication for Critical Functionality
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality.
- 7.5 High severity
HarmonyOS: Incorrect Authorization
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Read
The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
- 7.5 High severity
HarmonyOS: Improper Handling of Parameters
The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.
- 7.8 High severity
HarmonyOS: Deserialization of Untrusted Data
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Incorrect Default Permissions
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
- 7.5 High severity
HarmonyOS: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
- 7.4 High severity
HarmonyOS: URL Redirection to Untrusted Site
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
- 7.5 High severity
HarmonyOS: Allocation of Resources Without Limits or Throttling
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
- 7.5 High severity
The facial recognition module has a vulnerability in input parameter verification.
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
- 9.1 Critical severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.