Security Vulnerability Report
中文
CVE-2025-12736 CVSS 6.5 MEDIUM

CVE-2025-12736

Published: 2026-03-16 14:17:54
Last Modified: 2026-03-17 15:40:34

Description

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.

CVSS Details

CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:openatom:openharmony:5.0.3:*:*:*:-:*:*:* - VULNERABLE
OpenHarmony v5.0.3及之前所有版本
OpenHarmony < 5.0.4

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-12736 PoC - OpenHarmony Uninitialized Resource Information Disclosure // This PoC demonstrates triggering uninitialized resource usage in OpenHarmony #include <stdio.h> #include <stdlib.h> #include <string.h> // Simulated vulnerable function that uses uninitialized resource void vulnerable_resource_access() { char buffer[256]; // Vulnerability: buffer is not initialized before use // In real OpenHarmony, this would be a system call or API that // returns uninitialized kernel/user space memory printf("[*] Accessing resource without initialization\n"); // Simulate reading from uninitialized buffer printf("[!] Potential leaked data: %s\n", buffer); // In real exploit: // 1. Trigger specific system call in OpenHarmony // 2. The syscall returns uninitialized kernel buffer // 3. Read sensitive data from the buffer // 4. Data may contain: keys, credentials, config, etc. } int main() { printf("CVE-2025-12736 PoC - OpenHarmony Information Disclosure\n"); printf("Target: OpenHarmony v5.0.3 and prior\n\n"); // Trigger the vulnerability vulnerable_resource_access(); printf("\n[*] PoC demonstrates the concept of uninitialized resource usage\n"); printf("[*] Real exploitation requires specific OpenHarmony system calls\n"); return 0; } /* Real-world exploitation steps: 1. Identify target device running vulnerable OpenHarmony version 2. Obtain local access with low privileges (PR:L) 3. Trigger vulnerable code path via: - Specific system API calls - Resource allocation manipulation - Specific application interactions 4. Capture leaked data from uninitialized resources 5. Extract sensitive information (credentials, keys, configs) Note: This is a conceptual PoC. Actual exploitation requires deep understanding of OpenHarmony internals and specific vulnerable code paths in the target version. */

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-12736", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:17:54.323", "lastModified": "2026-03-17T15:40:33.853", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource."}, {"lang": "es", "value": "En OpenHarmony v5.0.3 y versiones anteriores permiten a un atacante local una fuga de información sensible a mayúsculas y minúsculas mediante el uso de un recurso no inicializado."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.0, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-908"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:openatom:openharmony:5.0.3:*:*:*:-:*:*:*", "matchCriteriaId": "191FD913-141A-4354-81C3-96C87D4D7CAE"}]}]}], "references": [{"url": "https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2025/2025-12.md", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}