CVE-2025-23420
Published: 04 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-23420, published on 2025-03-04, is an out-of-bounds write vulnerability (CWE-787) affecting OpenHarmony versions 5.0.2 and prior. It enables a local attacker to execute arbitrary code within pre-installed applications.
The vulnerability carries a CVSS v3.1 base score of 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). A local attacker with low privileges can exploit it under low complexity conditions without user interaction, achieving arbitrary code execution in pre-installed apps, though only in restricted scenarios. The changed scope reflects potential impact across security boundaries with low confidentiality effects.
For details on mitigation, patches, or workarounds, refer to the OpenHarmony security disclosure advisory at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Local out-of-bounds write enabling arbitrary code execution in pre-installed applications by a low-privileged local attacker directly maps to exploitation for privilege escalation.