CVE-2023-44112: High Out-of-Bounds Read in Huawei EMUI Authentication

CVE-2023-44112 is an out-of-bounds read in the device authentication module of Huawei EMUI 11.0.1, 12.0.0 and 13.0.0. The record scores it 7.5 (High) and Huawei's bulletin rates it Medium. It affects confidentiality only. Install the January 2024 security update as soon as your device offers it.

What's affected

The record lists EMUI 11.0.1, 12.0.0 and 13.0.0. Huawei's January 2024 security bulletin lists the same three EMUI versions and names the device authentication module. The bulletin page does not name specific fixed build numbers. It says the fix is part of the January 2024 update, so check your device's update status in Settings.

Severity differs. The record scores 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Huawei rates the issue Medium. We report both. Whichever you favour, the impact is limited to confidentiality: the vector shows no integrity or availability loss.

The weaknesses are CWE-200, CWE-125, an information exposure and an out of bounds read. The record does not mark the CVE as known exploited.

How to check if you're exposed

1. On a Huawei phone or tablet, open Settings, then System and updates, then Software update, and note the EMUI version and security patch level.
2. A device on EMUI 11.0.1, 12.0.0 or 13.0.0 with a patch level before the January 2024 security update should be treated as affected.
3. If you run a mobile device management tool, filter the fleet by manufacturer and security patch level.
4. Check Huawei's security bulletin page for your device model's update status.

Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.

What to do now

1. Install the January 2024 Huawei security update or any later one.
2. Where no update is offered for an older model, plan to replace the device.
3. Keep sensitive corporate data off unpatched devices.
4. Enforce a minimum patch level through device management if you can.
5. Record the patch level in your device inventory.

Why it matters

An out of bounds read means code reads memory beyond the area it was meant to use. The result is that data from nearby memory may leak. The record gives the impact as confidentiality only, so the worry is disclosure of information, not takeover of the device.

Huawei's description is short, and the bulletin does not explain how the data could be reached. The CVSS vector indicates network reach with no privileges and no user interaction, so we advise patching and not waiting for more detail.

Quick check

Sources

• Huawei consumer security bulletin, January 2024
• HarmonyOS security bulletin, January 2024 (record reference)

Last reviewed: 19 October 2026.