in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.
CVSS Details
CVSS Score
3.3
Severity
LOW
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
OpenHarmony <= v6.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
/*
* PoC for CVE-2026-33565 (OpenHarmony Local DoS)
* Description: This code simulates triggering the vulnerability
* by sending a malformed request to a vulnerable system service.
* Compilation: gcc -o poc_exploit poc_exploit.c
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
// Simulated vulnerable function call
void trigger_vulnerability(char *input) {
// In a real scenario, this function belongs to the system service
// and lacks proper NULL checks or length validation.
if (input == NULL) {
// This logic path might not be hit if the input is crafted differently
return;
}
// Simulating the crash condition (e.g., buffer overflow or null dereference)
// This is a placeholder for the actual exploit logic.
printf("[*] Sending payload to service...\n");
// Hypothetical system call that causes the crash
// memcpy((void *)0x0, input, strlen(input)); // Simulated Segfault
// Actual exploit would involve specific IOCTLs or API calls
// identified in the technical analysis.
}
int main() {
printf("[*] CVE-2026-33565 PoC Start\n");
printf("[*] Targeting OpenHarmony <= v6.0\n");
// Craft malicious payload
char *malicious_payload = "CRASH_PAYLOAD";
// Attempt to trigger the vulnerability
trigger_vulnerability(malicious_payload);
printf("[*] Exploit executed. If successful, system should hang or reboot.\n");
return 0;
}