OpenHarmony versions 5.0.3 through 6.0 are affected by an out-of-bounds write vulnerability that could allow for local privilege escalation or system compromise.

The product is susceptible to an out-of-bounds write (CWE-787) vulnerability, which can be exploited by an attacker with local, low-privileged access to corrupt memory and potentially modify system state.

A CVSS score of 8.4 indicates a high-severity risk, particularly in environments where local access to devices is possible. Successful exploitation could lead to privilege escalation, allowing an attacker to bypass security controls and gain unauthorized access to system resources.

Immediate Action: Check the OpenHarmony security disclosure portal for available updates and apply them to all affected instances immediately.

Proactive Monitoring: Audit system access logs and monitor for unauthorized attempts to escalate privileges or unexpected modification of system configuration files.

Compensating Controls: Restrict physical and local logical access to devices running OpenHarmony to authorized personnel only to prevent the initial access required for exploitation.

Public Exploit Available: Unknown.

Administrators should prioritize verifying the security status of all OpenHarmony deployments. Apply the necessary updates as soon as the vendor provides them to mitigate the risk of local privilege escalation and system compromise.