CVE-2025-27132

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-271338.8WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3 CVE-2025-271348.8Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to CVE-2025-271359.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL CVE-2025-271365.5LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoin CVE-2025-271374.4Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Depend CVE-2025-271389.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication CVE-2025-271395.4Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting wh CVE-2025-27144.3A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functi CVE-2025-271409.8WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the CVE-2025-271416.5Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.4 CVE-2025-271428.8LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network wit CVE-2025-271436.1Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open