Security readout for executives and security teams
Plain-English summary
CVE-2021-46885 is a Huawei HarmonyOS and EMUI video framework flaw. A math overflow can lead to memory overwrite, and successful exploitation may disrupt device availability. The public record rates it high severity, but the provided sources do not show data theft, privilege gain, or confirmed exploitation.
Executive priority
Treat as high priority only where affected Huawei devices are present. The main business risk is service disruption or device instability, not confirmed compromise. If Huawei devices are unmanaged or broadly deployed, prioritize inventory and patch confirmation.
Technical view
The issue is described as memory overwriting caused by addition overflow in the video framework, mapped to CWE-120. CVSS 3.1 is 7.5 with network attack vector, low complexity, no privileges, no user interaction, unchanged scope, and availability-only impact.
Likely exposure
Exposure is limited to Huawei HarmonyOS 2.1.0, 2.0.1, 2.0.0 and EMUI 12.0.1, 12.0.0, 11.0.0, 10.1.1, 10.1.0 per the source bundle.
Exploitation context
The bundle marks CISA KEV as false, and the cited sources do not state active exploitation. The CVSS vector indicates a remote, unauthenticated, low-complexity path with no user interaction, but public details do not identify the exact entry point.
Researcher notes
Evidence is sparse. The public description gives vulnerability class, affected versions, CVSS, and availability impact, but not exploit mechanics, affected components beyond the video framework, or fixed build identifiers. Avoid assuming code execution or exploitation in the wild from these sources.
Mitigation direction
- Inventory Huawei HarmonyOS and EMUI devices against the listed affected versions.
- Review Huawei's May 2023 security bulletin for vendor remediation guidance.
- Update affected devices to a vendor-supported build containing the relevant security fix.
- Reduce exposure to untrusted media or video processing paths where operationally possible.
- Monitor Huawei advisories for fixed build details if not already documented internally.
Validation and detection
- Confirm each device OS version and security patch level through device management records.
- Compare fleet versions with the affected HarmonyOS and EMUI version lists.
- Verify remediation against Huawei's May 2023 bulletin or subsequent Huawei guidance.
- Track crashes or availability incidents involving video framework processing.
- Document exceptions for devices that cannot receive supported updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-46885 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://consumer.huawei.com/en/support/bulletin/2023/5/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.