CVE-2024-28951

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Apr 2, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-289526.7Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially CVE-2024-289536.7Uncontrolled search path in some EMON software before version 11.44 may allow an authenticated user to potentially enable escalation of privCVE-2024-289546.7Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation CVE-2024-289555.9Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine tCVE-2024-289565.6Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow CVE-2024-289575.3Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote uCVE-2024-28968.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been rated as critical. This issue affects the function formWifiWpsStart of the fCVE-2024-289608.2An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandlesCVE-2024-289617.8Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged maliCVE-2024-289627.5Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulneraCVE-2024-289635.5Telemetry Dashboard v1.0.0.7 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with loCVE-2024-289647.8Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticat
CVE-2024-28951: High severity, CVSS 7.8 | Vulnix