CVE-2025-25277
Medium · 6.3CVSS
6.3
EPSS
0.2%
Published
Mar 16, 2026
CISA due date
—
The record
in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in… CWE-843
- CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes… CWE-843
- CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. CWE-843
- CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-843
- CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later… CWE-843
- CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… CWE-843
- CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843
- CVE-2026-87564 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843