CVE-2023-0083 - The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.

Back Back to CVE browser

MEDIUM

The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.

Published Mar 10, 2023

5.5

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions,

OpenHarmony-v3.0.7 and prior versions

has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash.

Affected products

Vendor OpenHarmony Product OpenHarmony Default
unaffected
Affected
- ≥ 3.0, ≤ 3.0.7
- ≥ 3.1, ≤ 3.1.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
OpenHarmony	OpenHarmony	unaffected	Affected ≥ 3.0, ≤ 3.0.7 ≥ 3.1, ≤ 3.1.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-843

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12184
Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-02.md
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12184		Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-02.md		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner OpenHarmony

Published Mar 10, 2023

Updated Feb 27, 2025

Reserved Jan 5, 2023

Link CVE-2023-0083

CISA Vulnrichment

Updated Feb 27, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-0083

Red Hat

No data

ENISA EUVD

Assigner OpenHarmony

Published Mar 10, 2023

Updated Feb 27, 2025

Link EUVD-2023-12184

GitHub

No data