CVE-2025-12736

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-127378.4The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malCVE-2025-127381.3Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who hasCVE-2025-127397.3An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supCVE-2025-12747.8A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leCVE-2025-127407.7A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to exeCVE-2025-127417.7A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to executCVE-2025-127427.5A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parametCVE-2025-127436.0The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a CVE-2025-127448.8A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input anCVE-2025-127457.8A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice ofCVE-2025-127466.1The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and inclCVE-2025-127475.3The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marke
CVE-2025-12736: Medium severity, CVSS 6.5 | Vulnix