Huawei vulnerabilities
We track 270 vulnerabilities in Huawei products across 60+ products. 270 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 2, 2026.
Latest Huawei vulnerabilities
- 7.8 High severity
HarmonyOS: Improper Control of Generation of Code
The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices.
- 7.5 High severity
HarmonyOS: Protection Mechanism Failure
The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The HISP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Write
The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause out-of-bounds access to the HIPP module and page table tampering, affecting device confidentiality an
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The HIPP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
- 9.8 Critical severity
HarmonyOS: Use After Free
The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of this vulnerability may allow attackers to obtain process control permissions.
- 7.5 High severity
HarmonyOS: Out-of-bounds Write
The HwAirlink module has a heap overflow vulnerability.Successful exploitation of this vulnerability may cause out-of-bounds writes, resulting in modification of sensitive data.
- 7.5 High severity
A Huawei device has an input verification vulnerability.
A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions include:CV81-WDM FW versions 01.70.49.29.46.
- 9.8 Critical severity
HarmonyOS: Improper Authentication
The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions.
- 9.1 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation.
- 9.1 Critical severity
EMUI: Buffer Copy without Checking Size of Input
Buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability will affect the confidentiality and integrity of trusted components.
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability.
- 9.8 Critical severity
HarmonyOS: Incorrect Default Permissions
The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation and unauthorized access to files.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applications to pop up windows or run in the background.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The AT commands of the USB port have an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability.
- 9.1 Critical severity
HarmonyOS: Incorrect Default Permissions
The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
- 9.8 Critical severity
CV81-WDM FW: Buffer Copy without Checking Size of Input
There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability may lead to privilege escalation.
- 7.5 High severity
HarmonyOS: Use of Externally-Controlled Format String
The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
- 9.8 Critical severity
HarmonyOS: Use After Free
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, and confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.
- 7.5 High severity
HarmonyOS: Improper Validation of Integrity Check Value
The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.
- 7.8 High severity
Mediatek Multiple Chipsets Insufficient Input Validation Exploited
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privilege
- 7.8 High severity
Android Kernel Use-After-Free Exploited
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or
- 9.8 Critical severity
Microsoft Remote Desktop Services Remote Code Execution Exploited
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code
- 8.1 High severity
Apache Struts Command Injection Exploited
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.