{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-26474", "assignerOrgId": "0cf5dd6e-1214-4398-a481-30441e48fafd", "state": "PUBLISHED", "assignerShortName": "OpenHarmony", "dateReserved": "2025-03-02T07:20:06.749Z", "datePublished": "2026-03-16T07:10:37.292Z", "dateUpdated": "2026-03-16T17:23:18.511Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0cf5dd6e-1214-4398-a481-30441e48fafd", "shortName": "OpenHarmony", "dateUpdated": "2026-03-16T07:10:37.292Z"}, "title": "communication_ipc an improper input validation vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "affected": [{"vendor": "OpenHarmony", "product": "OpenHarmony", "versions": [{"status": "affected", "version": "v5.0.3", "lessThanOrEqual": "v5.0.3.x", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios."}]}], "references": [{"url": "https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-09.md"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T17:22:32.173660Z", "id": "CVE-2025-26474", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:23:18.511Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-26474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T17:22:32.173660Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:23:14.227Z"}}], "cna": {"title": "communication_ipc an improper input validation vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenHarmony", "product": "OpenHarmony", "versions": [{"status": "affected", "version": "v5.0.3", "versionType": "custom", "lessThanOrEqual": "v5.0.3.x"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-09.md"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.", "supportingMedia": [{"type": "text/html", "value": "in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "providerMetadata": {"orgId": "0cf5dd6e-1214-4398-a481-30441e48fafd", "shortName": "OpenHarmony", "dateUpdated": "2026-03-16T07:10:37.292Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26474", "state": "PUBLISHED", "dateUpdated": "2026-03-16T17:23:18.511Z", "dateReserved": "2025-03-02T07:20:06.749Z", "assignerOrgId": "0cf5dd6e-1214-4398-a481-30441e48fafd", "datePublished": "2026-03-16T07:10:37.292Z", "assignerShortName": "OpenHarmony"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:openatom:openharmony:5.0.3:*:*:*:-:*:*:*", "matchCriteriaId": "191FD913-141A-4354-81C3-96C87D4D7CAE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios."}], "id": "CVE-2025-26474", "lastModified": "2026-03-17T19:57:02.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "scy@openharmony.io", "type": "Secondary"}]}, "published": "2026-03-16T14:17:57.253", "references": [{"source": "scy@openharmony.io", "tags": ["Vendor Advisory"], "url": "https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-09.md"}], "sourceIdentifier": "scy@openharmony.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "scy@openharmony.io", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[v5.0.3, v5.0.3.x]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenHarmony", "source": "cna", "vendor": "OpenHarmony"}, "product": "openharmony", "vendor": "openharmony"}], "analysis": {"en": {"generated_at": "2026-03-17T21:41:55.943373+00:00", "value": {"mitigation_remediation": ["Check the vendor's website or security advisories for an update that addresses this issue.", "Limit IPC interactions to trusted or signed applications and remove unnecessary IPC routes.", "Monitor system logs for abnormal IPC activity and apply local isolation such as containerization to reduce the attack surface."], "summary": {"action": "Assess Impact", "impact": "Information Disclosure (Local)"}, "threat_synthesis": {"affected_systems": "Affected vendors and products are OpenHarmony, specifically the OpenHarmony operating system. Versions v5.0.3 and all earlier releases are impacted. The Common Platform Enumeration string confirms the affected product as cpe:2.3:o:openatom:openharmony:5.0.3:*:*:*:-:*:*:*.", "description_and_impact": "The vulnerability is an improper input validation flaw in OpenHarmony's IPC communication module. It allows a local attacker to provide malformed data that can potentially expose internal information or cause unintended application behavior. This weakness is categorized as CWE-20 and does not enable remote code execution or privilege escalation.", "risk_and_exploitability": "The CVSS score is 3.3, indicating low severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that exploitation is unlikely and would require only local access under restricted scenarios. Attackers would need to run code or send crafted IPC messages from a trusted local process to trigger the flaw."}}}}, "created": "2026-03-17T09:53:06.456107+00:00", "updated": "2026-03-24T10:45:31.302839+00:00", "vendors": ["openharmony", "openharmony$PRODUCT$openharmony"]}