CVE-2026-24792
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
OpenHarmony version 6.0 and earlier allows a remote attacker to execute arbitrary code in pre-installed apps.
Risk Assessment
An attacker can remotely execute malicious code in pre-installed apps, potentially leading to full device compromise and data leakage.
Recommendation
Update OpenHarmony to a version later than 6.0, which fixes this vulnerability.
Other vulnerabilities in OpenHarmony
See all- CVE-2026-33565Low
Vulnerability in OpenHarmony version 6.0 and earlier. A local attacker can cause a denial of service (DOS).
- CVE-2026-28751Low
Vulnerability in OpenHarmony version 6.0 and earlier allows a local attacker to cause denial of service (DoS).
- CVE-2026-28733Medium
In OpenHarmony v6.0 and prior versions, a vulnerability allows a local attacker to execute arbitrary code.
- CVE-2026-27781Low
A local attacker can cause a denial of service (DoS) in OpenHarmony v6.0 and prior versions.
- CVE-2026-27766Medium
Vulnerability in OpenHarmony v6.0 and prior versions allows a local attacker to cause information leak.
- CVE-2026-27648High
OpenHarmony version 6.0 and earlier allows a remote attacker to execute arbitrary code in pre-installed apps.
- CVE-2026-25850Medium
In OpenHarmony v6.0 and prior versions, a vulnerability allows a local attacker to cause information leak.
- CVE-2026-25781High
OpenHarmony v6.0 and prior versions allow a local attacker to cause a denial of service (DoS) that makes the system unavailable and unrecoverable without intervention.
- CVE-2026-25110Low
A vulnerability in OpenHarmony v6.0 and prior versions allows a local attacker to cause a denial of service (DoS).
Original NVD description (English source)
in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.