CVE-2026-41971

Vulnerability

A permission control vulnerability exists in the security control module of Huawei devices running HarmonyOS 6.0.0 [2]. The flaw arises from improper permission checks, potentially allowing an attacker to bypass intended access restrictions. The affected version is explicitly listed in the May 2026 security bulletin for Huawei PCs [2].

Exploitation

The available references do not disclose specific exploitation prerequisites or steps. However, as a permission control issue, exploitation likely requires local access or the ability to execute code at a certain privilege level. No further details are provided in the advisory [2].

Impact

Successful exploitation of this vulnerability may affect service confidentiality [2]. The attacker could gain unauthorized access to sensitive information processed by the security control module. The impact is limited to confidentiality; integrity and availability are not mentioned.

Mitigation

Huawei has released a security update in May 2026 that addresses this vulnerability [2]. Users are advised to apply the update to HarmonyOS 6.0.0 devices. No workarounds are documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.