CVE-2026-41972: SMS App Path Traversal Vulnerability

CVE-2026-41972 Overview

CVE-2026-41972 is a path traversal vulnerability [CWE-22] affecting the SMS application on Huawei consumer devices. The flaw allows an attacker to manipulate file paths to access resources outside intended directories. Successful exploitation may affect device availability through limited integrity and availability impact.

The vulnerability requires user interaction and is reachable over a network attack vector. Huawei disclosed the issue in its June 2026 consumer security bulletin. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
Successful exploitation of this path traversal flaw in the SMS app may affect availability and allow limited unauthorized file access on impacted Huawei devices.

Affected Products

Huawei consumer devices running the affected SMS app (see Huawei Security Bulletin for specific versions)
Huawei HarmonyOS / EMUI builds shipping the vulnerable SMS application
Devices that have not applied the June 2026 Huawei security update

Discovery Timeline

2026-06-09 - CVE-2026-41972 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41972

Vulnerability Analysis

The vulnerability resides in the SMS application's handling of file path inputs. The application fails to properly validate or canonicalize path components supplied through message-related operations. An attacker can craft input containing directory traversal sequences such as ../ to reference files outside the intended storage directory.

Because the attack vector is network-based and requires user interaction, exploitation typically depends on a victim opening or processing a crafted message. The scope remains unchanged, meaning the impact is constrained to the SMS app's security context. The Common Weakness Enumeration classification is [CWE-22] - Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing or insufficient input sanitization on file path parameters processed by the SMS app. The application trusts path components without resolving them against an allow-listed base directory. This allows traversal characters to escape the intended sandbox and reference arbitrary file locations accessible to the SMS process.

Attack Vector

An attacker delivers a crafted payload that the SMS app processes when the user interacts with it. The malicious path leverages traversal sequences to read or overwrite files the SMS process can access. The resulting impact includes limited integrity loss and possible disruption of SMS app availability. See the Huawei Security Bulletin for vendor-confirmed technical details.

Detection Methods for CVE-2026-41972

Indicators of Compromise

Unexpected file access errors or crashes originating from the SMS application process
Presence of files containing ../ or encoded traversal sequences in SMS app storage directories
SMS app accessing files outside its expected sandbox paths during message processing

Detection Strategies

Inspect mobile device logs for SMS app exceptions referencing unexpected file paths or permission denials
Monitor for SMS application crashes correlated with receipt or opening of messages from untrusted senders
Review device security telemetry for anomalous file I/O attempts by the SMS process

Monitoring Recommendations

Track Huawei security bulletin updates for the affected SMS app component and related patches
Enroll Huawei devices in mobile device management (MDM) to enforce timely patch deployment
Correlate SMS-related crash reports with EPSS and threat intelligence feeds to prioritize response

How to Mitigate CVE-2026-41972

Immediate Actions Required

Apply the June 2026 Huawei security update referenced in the Huawei Security Bulletin as soon as it is available for the device model
Advise users to avoid opening SMS messages or attachments from untrusted or unknown senders
Inventory Huawei consumer devices in the environment and identify those running affected SMS app versions

Patch Information

Huawei addressed CVE-2026-41972 in the June 2026 consumer security bulletin. Device owners should install the latest system update through Settings or via MDM-managed update channels. Refer to the Huawei Security Bulletin for the specific firmware versions and patch identifiers applicable to each device model.

Workarounds

Disable or restrict use of the default SMS app on impacted devices until the patch is installed
Use messaging filtering features to block messages from unknown senders where supported
Enforce mobile security policies that limit installation of untrusted apps and links delivered through SMS

bash

# Configuration example - verify Huawei device patch level via ADB
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.emui