CVE-2023-52359 is a high severity flaw in the ActivityTaskManagerService module of Huawei EMUI, scored 7.5 by NVD. Huawei fixed it in its March 2024 security update, so install the latest system update on affected phones and tablets. Huawei rates it High, so read both ratings.
What's affected
The weak spot is in the ActivityTaskManagerService module. Huawei lists the affected versions as EMUI 13.0.0 and EMUI 12.0.0. The NVD record also names HarmonyOS builds, and the product list in the record is broader than the bulletin wording, so the bulletin for your device family is the one to follow.
The stated impact is: Successful exploitation will affect availability. The fix is part of Huawei's March 2024 monthly security update. I could not confirm a specific build number from the bulletin text, so treat the update level for your device as something to check on the device itself.
Weakness class: CWE-285.
Severity differs between sources. NVD scores this 7.5 (High, CVSS 3.1). The Huawei bulletin labels the same entry High. The vendor and NVD rate on different scales and inputs, and neither source explains the gap. Use the higher figure when you set patch priority, and use the bulletin to see which devices are covered.
How to check if you're exposed
This is a vendor firmware fix, so there is no package command to run. Check the device itself.
Open Settings, go to System and updates, then Software update, and see whether an update is waiting. Then compare the installed build against the March 2024 bulletin for your model on the Huawei support site. Exact menu names vary by EMUI release.
For a fleet managed by mobile device management, export the OS build for each Huawei device and flag anything older than the bulletin month. EMUI 12 and 13 devices that no longer receive updates cannot be fixed this way and should be treated as exposed.
What to do now
- Update every affected Huawei phone and tablet to the latest EMUI or HarmonyOS system update.
- Read the March 2024 bulletin entry for this CVE and confirm your model and EMUI version are listed.
- Pull devices that cannot take the update off sensitive networks and data.
- Record the decision in your asset inventory, with the Huawei severity and the NVD score side by side.
Why it matters
The flaw is a missing or weak permission check in some APIs of the module that manages app activities. When a system API does not check who is asking, an app that should not be allowed to call it can use it. The stated result here is an availability impact.
NVD lists no exploitation for this CVE and the CISA Known Exploited Vulnerabilities flag in the record is false. Huawei publishes bulletin entries in short form, so details such as the exact trigger are not public. Plan on the information you have and avoid guessing at attack paths.
Quick check
Is CVE-2023-52359 exploited in the wild?
The record shows it is not in the CISA Known Exploited Vulnerabilities catalog, and the bulletin does not say it is exploited. That can change, so check the Gold page for current status.
Why do NVD and Huawei disagree on severity?
NVD reports 7.5, while Huawei labels the entry High. Neither source gives its reasoning, so I report both and suggest patching on the higher rating.
Sources
Last reviewed: 19 October 2026.
