CVE-2025-64314

The vulnerability consists of improper permission control in the memory management module, classified as type confusion (CWE-843). The attack vector indicates local access without privilege requirements and without user interaction, however with potential impact exceeding the scope of the attacked component (Scope: Changed). An attacker operating locally can manipulate object types in memory in a manner exceeding their assigned privileges.

Successful exploitation of the vulnerability may result in data confidentiality breach — the vendor indicates impact on confidentiality. The CVSS vector also indicates high impact on integrity and availability, suggesting the possibility of unauthorized data access, resource modification, or system destabilization.

Security patches available from the vendor should be applied according to references — security bulletin available at: https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/

Huawei HarmonyOS — specific versions indicated in vendor references (Huawei security bulletin from November 2025)