CVE-2026-28733: OpenHarmony RCE Vulnerability

CVE-2026-28733 Overview

CVE-2026-28733 is a use-after-free vulnerability [CWE-416] affecting OpenHarmony v6.0 and prior versions. A local attacker with low privileges can exploit this flaw to achieve arbitrary code execution on the affected system. The vulnerability requires no user interaction and operates with low attack complexity, but is constrained to local attack vectors. Successful exploitation impacts system availability without directly affecting confidentiality or integrity, though the scope changes during exploitation. OpenHarmony documented the issue in its May 2026 security disclosure bulletin.

Critical Impact

A local, low-privileged attacker can trigger memory corruption in OpenHarmony to execute arbitrary code and disrupt system availability.

Affected Products

• OpenHarmony v6.0
• OpenHarmony versions prior to v6.0

Discovery Timeline

• 2026-05-19 - CVE-2026-28733 published to the National Vulnerability Database (NVD)
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-28733

Vulnerability Analysis

CVE-2026-28733 is categorized as a use-after-free condition in OpenHarmony, an open-source operating system maintained for IoT and smart device deployments. The flaw allows a local attacker holding low-level privileges on the device to manipulate memory that has already been released by the allocator. When the affected component dereferences the dangling pointer, the attacker can redirect execution flow toward attacker-controlled data. This leads to arbitrary code execution within the context of the vulnerable process.

The vulnerability requires local access, meaning the attacker must already have a foothold on the device through a shell, an installed application, or another compromised process. No user interaction is required to trigger the condition. The scope is marked as changed, indicating that exploitation can affect components beyond the initially vulnerable module.

Root Cause

The root cause is improper memory lifecycle management within an OpenHarmony component. The application continues to use a pointer after the underlying object has been freed, leading to undefined behavior when the freed memory is reallocated and populated with attacker-controlled data. Use-after-free flaws of this nature commonly occur when reference counting, object ownership, or asynchronous callback handling fails to synchronize with allocator state.

Attack Vector

Exploitation requires local code execution capability, typically through a malicious application or a compromised low-privilege account. The attacker triggers the vulnerable code path, forces the target object to be freed, and then reallocates the memory region with crafted contents. When the application subsequently dereferences the stale pointer, the attacker controls the execution context. The OpenHarmony security advisory provides additional component-level technical details. Verified proof-of-concept code is not publicly available at this time.

Refer to the OpenHarmony Security Disclosure for vendor technical details.

Detection Methods for CVE-2026-28733

Indicators of Compromise

• Unexpected process crashes or abnormal termination of OpenHarmony system services with signals such as SIGSEGV or SIGABRT
• Installation of unsigned or untrusted applications shortly before service instability
• Anomalous child processes spawned from OpenHarmony system components

Detection Strategies

• Monitor system logs and hilog output for memory corruption signatures, including heap consistency check failures and ASan-style reports
• Apply behavioral analytics to flag local privilege transitions originating from low-privilege application sandboxes
• Audit installed application packages and correlate against permission anomalies and recent process crashes

Monitoring Recommendations

• Centralize OpenHarmony device telemetry into a security data lake for cross-device correlation of crash patterns
• Track repeated allocator failures or use-after-free heuristics emitted by hardened memory allocators
• Alert on unauthorized changes to system component binaries or shared libraries on managed OpenHarmony fleets

How to Mitigate CVE-2026-28733

Immediate Actions Required

• Inventory OpenHarmony deployments and identify devices running v6.0 or earlier
• Restrict installation of third-party applications on affected devices until patches are deployed
• Enforce least-privilege application sandboxing to limit local attacker capabilities

Patch Information

OpenHarmony has documented the vulnerability in its May 2026 security disclosure. Apply the patched OpenHarmony release referenced in the OpenHarmony Security Disclosure as soon as the corresponding device-specific update is available from the OEM or distribution maintainer.

Workarounds

• Remove or disable untrusted applications that could be used to gain local code execution
• Limit administrative shell access on production OpenHarmony devices to authorized personnel only
• Monitor system component behavior for repeated crashes that may indicate exploitation attempts

# Identify the OpenHarmony version on a target device
hdc shell param get const.ohos.version.release

# List installed third-party applications for review
hdc shell bm dump -a