CVE-2026-41960: Calls Permission Control DOS Vulnerability

CVE-2026-41960 Overview

CVE-2026-41960 is a permission control vulnerability affecting the calls functionality in Huawei consumer products. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Successful exploitation may affect availability of the impacted component. The vulnerability is exploitable over the network but requires user interaction and has high attack complexity, limiting practical exploitation. Huawei disclosed the issue in its May 2026 consumer security bulletin.

Critical Impact
Successful exploitation of this permission control weakness in the calls component may degrade availability of the affected functionality.

Affected Products

Huawei consumer devices referenced in the May 2026 security bulletin
Specific product models and versions disclosed by Huawei advisory
Calls component within affected device firmware

Discovery Timeline

2026-05-15 - CVE-2026-41960 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-41960

Vulnerability Analysis

The vulnerability resides in permission control logic governing the calls functionality on affected Huawei devices. The component fails to enforce proper authorization checks, mapping to the [CWE-200] weakness class. An attacker who successfully exploits the issue can impact availability, with limited impact to confidentiality and integrity. The scope is changed, meaning the vulnerable component can affect resources beyond its own security boundary.

The attack vector is network-based but requires user interaction to trigger the vulnerable code path. The high attack complexity reflects conditions outside the attacker's control that must be satisfied for exploitation. EPSS data indicates a low probability of exploitation activity in the near term.

Root Cause

The root cause is improper permission control in the calls subsystem. The component does not adequately validate caller permissions before exposing protected functionality. This permits an unauthorized actor to interact with call-related resources in a way that disrupts intended access boundaries. Huawei has not publicly released low-level technical details about the specific code path affected.

Attack Vector

Exploitation requires the attacker to deliver a crafted network input and induce a user to perform an action that triggers the vulnerable path. Because scope is changed, the affected calls component can influence other components on the device. No public proof-of-concept code, exploit module, or in-the-wild exploitation has been reported. Refer to the Huawei Security Bulletin for vendor-supplied technical context.

No verified public code samples are available. The vulnerability is described in prose by the vendor advisory only.

Detection Methods for CVE-2026-41960

Indicators of Compromise

Unexpected disruption or termination of call functionality on affected Huawei devices
Anomalous network traffic to device call services preceding availability loss
Crash or restart events logged by the calls subsystem without user action

Detection Strategies

Monitor mobile device management (MDM) telemetry for repeated calls subsystem failures across affected device fleets
Review device logs for permission denial events or unexpected privilege checks within the calls component
Correlate user reports of degraded call availability with network exposure of affected device versions

Monitoring Recommendations

Track Huawei security bulletin updates and apply firmware versions as released
Inventory Huawei consumer devices in the environment and map them against the May 2026 bulletin
Alert on devices that remain on pre-patch firmware after the vendor remediation window

How to Mitigate CVE-2026-41960

Immediate Actions Required

Apply the firmware update referenced in the Huawei Security Bulletin for May 2026
Identify all affected Huawei consumer devices and verify their current firmware version
Restrict untrusted network access to vulnerable devices until patches are applied

Patch Information

Huawei published remediation guidance in its May 2026 consumer security bulletin. Administrators should consult the bulletin for the list of affected models, fixed firmware versions, and update procedures. Refer to the Huawei Security Bulletin for authoritative version information.

Workarounds

Avoid interacting with untrusted call-related prompts or links on affected devices
Limit network exposure of affected devices by using trusted Wi-Fi and VPN connections
Disable or restrict third-party call applications on impacted devices until firmware is updated

bash

# Verify device firmware version against vendor advisory
# Replace with vendor-supplied tooling or device settings menu
adb shell getprop ro.build.version.incremental
adb shell getprop ro.product.model