Huawei HarmonyOS and EMUI vibration service denial-of-service vulnerability

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.

The normalized record marks default_status as unaffected for both products; only the explicitly listed versions are confirmed affected:

• Huawei Harmony OS: 4.3.1, 4.3.0, 4.2.0, 4.0.0.
• Huawei EMUI: 15.0.0, 14.2.0, 14.0.0.
• Huawei's phones/tablets security bulletin lists the same HarmonyOS and EMUI branches. A separate HUAWEI Vision bulletin lists only HarmonyOS4.3.0; the available evidence does not extend that Vision listing to other versions.

No evidence confirms that unlisted versions are affected or that a particular version is fixed.

The vulnerability affects the vibration service and is classified as CWE-789, memory allocation with an excessive size value. The available record does not disclose the specific input, processing path, allocation condition, or exact failure behavior in the implementation. The assessment data describes a network-reachable attack that requires no privileges and requires user interaction; attack complexity is described as low. An attacker-controlled or attacker-influenced size causing an excessive allocation is consistent with this weakness class, but it is not confirmed as a specific exploit path. The documented outcome is denial of service that may affect availability.

The record describes network reachability, no required privileges or authentication, low attack complexity, and required user interaction. The public_exploit field is false, so no public exploit is recorded in the supplied data. Actual exploitation status is not established because known_exploited is null. No exploit steps, payload, campaign, victim, or specific exploitation indicator is documented.

The vulnerability may cause denial of service in the vibration service and affect device availability. The technical attributes in the record indicate no direct confidentiality or integrity impact, unchanged scope, and no required privileges for the described attack path. Exploitation still requires user interaction, so the practical effect depends on how the device and service are used. The record does not establish device takeover, privilege escalation, data disclosure, or data modification.

• Affected devices or the vibration service may become disrupted, reducing device availability.
• An organization may face unstable devices, interrupted functions, and increased support effort if exploitation occurs.
• The available evidence does not show a direct confidentiality or integrity impact and does not establish privilege escalation.
• No breach, attack campaign, or data loss is identified in the supplied evidence.

1. Install the applicable Huawei security update for each affected device and deployment, following Huawei's release guidance.
2. Verify the installed version after updating and retain inventory evidence for each HarmonyOS or EMUI branch. Do not assume that every later version is fixed because the record does not provide branch-specific fixed releases.
3. If updating is not immediately possible, apply deployment-appropriate temporary network controls to reduce network reachability, treating this as general risk reduction rather than a Huawei-confirmed workaround.
4. No solution text or specific workaround is supplied in the record. The patch status of branches not explicitly listed remains unverified.

• Inventory Huawei devices running HarmonyOS or EMUI and compare the exact installed version with the affected branches.
• Check the Huawei security-update state on devices that use the vibration service.
• Assess phones/tablets and HUAWEI Vision separately because Huawei's notices do not document the same deployment scope for every product line.
• Monitoring unexpected failures or interruptions of the vibration service may be used as a precaution, but the record provides no confirmed log event or IOC.
• Do not treat the absence of log evidence or alerts as proof that a device is safe.