Race Condition Vulnerability in OpenHarmony Affects Local Security
CVE-2025-25278

7HIGH

Key Information:

Vendor

Openharmony

Status
Openharmony
Vendor
CVE Published:
11 August 2025

What is CVE-2025-25278?

In OpenHarmony versions v5.0.3 and earlier, a local attacker can exploit a race condition affecting the Trusted Computing Base (TCB), enabling arbitrary code execution. This vulnerability underscores the importance of addressing synchronization issues in software to prevent unauthorized actions by local users.

Affected Version(s)

OpenHarmony v5.0.3

References

https://gitee.com/openharmony/security/blob/master/zh/sec...

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.