OpenHarmony CVE-2026-25781 Allows Local DOS, Unrecoverable Impact

A critical denial-of-service vulnerability, CVE-2026-25781, has been identified in OpenHarmony v6.0 and earlier versions. This flaw, attributed to CWE-787 (Improper Neutralization of Special Elements used in a Command), allows a local attacker to trigger a denial of service that is unrecoverable, according to the National Vulnerability Database.

National Vulnerability Database analysis indicates a CVSS score of 8.4 (HIGH) for this vulnerability. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N highlights that the attack requires local access and low privileges, but its impact is severe, leading to complete system unavailability without recovery.

For defenders, this means any OpenHarmony device with local user access is at risk. The attacker’s calculus is straightforward: gain local access, execute the exploit, and render the device unusable. CISOs must prioritize patching and strictly control local access to these systems. The unrecoverable nature of the DOS means incident response will involve system re-provisioning, a costly and disruptive exercise.