Security Bulletins for HUAWEI Phones/Tablets, May 2026
HUAWEI is releasing monthly security updates for flagship models. This security update includes HUAWEI and third-party library patches:
This security update includes the following HUAWEI patches:
| CVE | Vulnerability Description | Impact | Severity | Affected Version |
|---|---|---|---|---|
| CVE-2026-41964 | Permission control vulnerability in the web | Successful exploitation of this vulnerability may affect availability. | High | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2026-41960 | Permission control vulnerability in calls | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2026-41961 | Permission control vulnerability in contacts | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-41962 | Permission control vulnerability in the app management and control module | Successful exploitation of this vulnerability may affect service confidentiality. | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2026-41963 | Stack overflow vulnerability in the media platform | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2026-41965 | Use-After-Free (UAF) vulnerability in the web | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2026-41966 | Permission control vulnerability in the smart sensing service | Successful exploitation of this vulnerability may affect service confidentiality. | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-41967 | Permission control vulnerability in the manufacturability design module | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-41968 | Permission control vulnerability in the manufacturability design module | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-41969 | Permission control vulnerability in the projection module | Successful exploitation of this vulnerability may affect service confidentiality. | Medium | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2026-41970 | Out-of-bounds write vulnerability in the distributed file system module | Successful exploitation of this vulnerability may affect availability. | Medium | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, HarmonyOS3.1.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0, EMUI 13.0.0 |
| CVE-2026-41971 | Permission control vulnerability in the security control module | Successful exploitation of this vulnerability may affect service confidentiality. | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
This security update includes the following third-party library patches:
| CVE | Severity | Affected Version |
|---|---|---|
| CVE-2026-0049 | Critical | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2026-0013 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-32313 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48568 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48609 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48630 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48634 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48644 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48650 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2026-0005 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2026-0020 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-48569 | High | HarmonyOS4.3.1, HarmonyOS4.3.0, HarmonyOS4.2.0, HarmonyOS4.0.0, EMUI 15.0.0, EMUI 14.2.0, EMUI 14.0.0 |
| CVE-2025-9230 | High | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-33636 | High | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2025-69421 | High | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-69420 | High | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-69419 | High | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-5068 | High | HarmonyOS5.1.0 |
| CVE-2025-5063 | High | HarmonyOS5.1.0 |
| CVE-2025-15467 | High | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-0992 | Low | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-0989 | Low | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-6170 | Low | HarmonyOS5.1.0 |
| CVE-2025-57812 | Low | HarmonyOS6.1.0 |
| CVE-2026-27766 | Medium | HarmonyOS6.0.0 |
| CVE-2026-25646 | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-22693 | Medium | HarmonyOS6.0.0 |
| CVE-2026-1757 | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-0990 | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-28164 | Medium | HarmonyOS6.0.0 |
| CVE-2025-28162 | Medium | HarmonyOS6.0.0 |
| CVE-2026-33416 | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2026-23865 | Medium | HarmonyOS6.1.0, HarmonyOS6.0.0 |
| CVE-2026-22796 | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2026-22795 | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-69418 | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-68160 | Medium | HarmonyOS6.0.0, HarmonyOS5.1.0 |
| CVE-2025-5064 | Medium | HarmonyOS5.1.0 |
| CVE-2025-49794 | Medium | HarmonyOS5.1.0 |
| CVE-2025-4664 | Medium | HarmonyOS5.1.0 |
Updated on: 2026-05-07