OpenHarmony v6.0 RCE: Pre-Installed Apps Vulnerable

The National Vulnerability Database (NVD) has documented CVE-2026-24792, a high-severity arbitrary code execution vulnerability affecting OpenHarmony v6.0 and earlier. This flaw, rated 8.1 CVSS (HIGH), allows a remote attacker to execute arbitrary code within pre-installed applications.

The core issue, categorized as CWE-364 (Improper Handling of Duplicate Resources), points to a logic flaw where duplicate or conflicting resource handling can be abused. While specific affected products beyond the OpenHarmony OS are not detailed by the NVD, the implications for devices running this operating system are significant. Any device utilizing OpenHarmony as its foundational OS, particularly those with pre-installed applications that cannot be easily removed or updated by the user, is at risk.

This isn’t just a theoretical vulnerability; remote code execution in pre-installed applications offers a persistent and privileged foothold. Attackers can leverage this to exfiltrate data, install further malware, or establish long-term persistence on compromised devices. The attacker’s calculus here is straightforward: target the OS layer to gain control over the entire device ecosystem, bypassing user interaction for initial compromise.