CVE-2026-41965

CVE-2026-41965 is a Use-After-Free (UAF) vulnerability in the web component of Huawei's HarmonyOS. The root cause is improper memory management, where a memory object is freed but still referenced, leading to undefined behavior. This vulnerability affects HarmonyOS versions 6.1.0 and 6.0.0, as listed in the May 2026 security bulletin for Huawei PCs [2].

Exploitation of this vulnerability likely requires an attacker to trigger the use-after-free condition through crafted input or specific operations within the web component. No authentication or user interaction is explicitly mentioned, but the attack surface is limited to the web subsystem. Successful exploitation could cause the system to crash or become unresponsive, affecting availability.

The impact is limited to availability; there is no indication of confidentiality or integrity compromise. Huawei has rated this vulnerability as Medium severity with a CVSS v3 score of 5.6.

Huawei has released security updates to address this vulnerability as part of its May 2026 security bulletin [2]. Users are advised to update their devices to the latest firmware versions to mitigate the risk.