OpenHarmony 5.0.3: Local info leak via uninitialized resource
CVE-2025-12736 Published on March 16, 2026
multimedia_audio_standard has an insecure storage of sensitive information vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.
Vulnerability Analysis
CVE-2025-12736 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Products Associated with CVE-2025-12736
Want to know whenever a new CVE is published for OpenHarmony? stack.watch will email you.
Affected Versions
OpenHarmony:- Version v5.0.3, <= v5.0.3.x is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.