OpenHarmony Out-of-Bounds Write Vulnerability in arkcompiler_ets_runtime Allowing Arbitrary Code Execution

A vulnerability in OpenHarmony versions through 5.1.0 that allows local attackers to execute arbitrary code in pre-installed applications. This issue arises from an out-of-bounds write vulnerability and can only be exploited in certain restricted scenarios.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution in the context of the affected application.

Remediation

Users can apply the available patches for this vulnerability in the OpenHarmony-5.1.0-Release and OpenHarmony-5.0.3-Release branches. Instructions for applying the patch can be found in the OpenHarmony security disclosure for October 2025.