{"id":"CVE-2026-101186","kind":"vulnerability","aliases":["CVE-2026-101186"],"related":[],"title":"Huawei HarmonyOS 6.1.0 window module flaw can cause denial of service","description":"DoS vulnerability in the window module.\nImpact: Successful exploitation of this vulnerability may affect availability.","summary":"Huawei's October 2026 security bulletin lists a denial-of-service flaw in the window module of HarmonyOS 6.1.0, rated Medium by Huawei (NVD CVSS 7.5 from Huawei as CNA, network/no auth). Successful exploitation may affect availability. No exploitation or PoC found.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HarmonyOS","fixed":[],"affected":"6.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","harmonyos","huawei","other","window-module"],"not_affected_if":["harmonyos-4","harmonyos-7"],"how_to_check":"On the Huawei device: Settings > About, check the HarmonyOS version; 6.1.0 without the October 2026 security update is listed as affected. The bulletin gives no patch-level string.","fix":"Install the HUAWEI October 2026 security update (Settings > System & updates > Software update). Huawei's bulletin does not state a specific fixed build.","status":"open","published_at":"2026-11-02T07:18:03+00:00","first_seen_at":"2026-11-02T07:21:56+00:00","triaged_at":"2026-11-02T07:22:21+00:00","updated_at":"2026-11-02T07:23:05+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-02T07:22:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Window module flaw lets an attacker cause denial of service","impact":"low","summary":"A denial-of-service flaw exists in a module named window, per the NVD entry. A successful attack may make the affected software unavailable.","audience":"developers","category":"other","nicknames":[],"who_cares":["window-module"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Service becomes unavailable to legitimate users","analyst_note":"Identify which product and package the window module belongs to; check https://nvd.nist.gov/vuln/detail/CVE-2026-101186 for affected versions and fix.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000569,"input_tokens":4037,"output_tokens":330,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify which product and package the window module belongs to; check https://nvd.nist.gov/vuln/detail/CVE-2026-101186 for affected versions and fix.","search":"'-101186':14A,17A '-2026':13A,16A '2026':32B '6.1.0':3A,48B '7.5':55B 'affect':65B,85C 'auth':61B 'avail':66B,86C 'bulletin':34B 'caus':8A 'cna':59B 'cve':12A,15A 'cvss':54B 'denial':9A,20B,38B 'denial-of-servic':19B,37B 'dos':72C 'exploit':63B,68B,80C 'flaw':6A,41B 'found':71B 'harmonyo':2A,23B,47B 'harmonyos':18A 'huawei':1A,24B,29B,52B,57B 'impact':78C 'list':35B 'may':64B,84C 'medium':50B 'modul':5A,28B,45B,77C 'network/no':60B 'nvd':53B 'octob':31B 'poc':70B 'rate':49B 'secur':33B 'servic':11A,22B,40B 'success':62B,79C 'vulner':73C,83C 'window':4A,27B,44B,76C 'window-modul':26B","nicknames":[],"mitigations":[],"who_affected":"Devices running HUAWEI HarmonyOS 6.1.0 (listed in the October 2026 bulletins for phones/tablets and PCs). HarmonyOS 7.0.0 and 4.x/EMUI are not listed for this CVE. Teams that do not use Huawei devices can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-11-02T07:23:05Z","by":"analyst","doc":"https://consumer.huawei.com/cn/support/bulletinlaptops/2026/10/","run_id":1357}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update your Huawei phone, tablet or PC to the latest HarmonyOS version: Settings > System & updates > Software update.","pkeys":["harmonyos"],"ptokens":["harmonyos"],"labels":["denialofservice","harmonyos","high","huawei","other","windowmodule"],"first_public_at":"2026-11-02T07:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@huawei.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101186","severity":null,"published_at":"2026-11-02T07:18:03+00:00","modified_at":"2026-11-02T07:18:03+00:00","first_seen_at":"2026-11-02T07:21:56+00:00","fetched_at":"2026-11-02T07:21:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101186:1357","url":null,"severity":null,"published_at":"2026-11-02T07:23:05+00:00","modified_at":"2026-11-02T07:23:05+00:00","first_seen_at":"2026-11-02T07:23:05+00:00","fetched_at":"2026-11-02T07:23:05+00:00","note":"Found in Huawei Oct 2026 bulletin (phones/tablets EN page; PCs CN page): HarmonyOS6.1.0, DoS, window module, Medium per Huawei; NVD 7.5 by Huawei CNA. Fixed build not stated, so fix unverified. Severity left as is."}],"documents":[{"id":50795,"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","title":"Security Bulletins for HUAWEI Phones/Tablets, October 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":50799,"url":"https://consumer.huawei.com/cn/support/bulletinlaptops/2026/10/","title":"华为电脑安全更新 2026年10月","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}