CVE-2025-12736
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows a local attacker to access sensitive information that should not be visible, due to a flaw in how the system handles uninitialized resources. The attacker needs to have local access to the device running affected versions of OpenHarmony, specifically v5.0.3 or earlier.
Technical Description
in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 16, 2026
23 days ago
Last Modified
Mar 17, 2026
22 days ago
Vendor
openatom
Product
openharmony
Related Vulnerabilities
This vulnerability allows a local attacker to run their own code within pre-installed apps on OpenHarmony devices, potentially leading to unauthorized access or control. However, it can only be exploited in specific situations where the attacker has local access to the device.
This vulnerability allows a local attacker to run any code they want in pre-installed apps on OpenHarmony devices, which could lead to unauthorized actions or data access. However, the attack can only happen in specific situations where the attacker has physical access to the device.
This vulnerability allows a local attacker to manipulate input data, potentially leading to incorrect information being processed by the system. However, it can only be exploited in specific, limited situations where the attacker has local access to the device.
This vulnerability allows a local attacker to run their own code within pre-installed apps on OpenHarmony devices, potentially taking control of those apps. However, it can only be exploited in specific situations where the attacker has access to the device.