CVE-2023-52387 is a high severity flaw in the GPU module of Huawei EMUI, scored 7.5 by NVD. Huawei fixed it in its February 2024 security update, so install the latest system update on affected phones and tablets. Huawei rates it Critical, so read both ratings.
What's affected
The weak spot is in the GPU module. Huawei lists the affected versions as EMUI 13.0.0. The NVD record also names HarmonyOS builds, and the product list in the record is broader than the bulletin wording, so the bulletin for your device family is the one to follow. The bulletin names EMUI 13.0.0 only.
The stated impact is: Successful exploitation may affect service confidentiality. The fix is part of Huawei's February 2024 monthly security update. I could not confirm a specific build number from the bulletin text, so treat the update level for your device as something to check on the device itself.
Weakness class: CWE-664.
Severity differs between sources. NVD scores this 7.5 (High, CVSS 3.1). The Huawei bulletin labels the same entry Critical. The vendor and NVD rate on different scales and inputs, and neither source explains the gap. Use the higher figure when you set patch priority, and use the bulletin to see which devices are covered.
How to check if you're exposed
This is a vendor firmware fix, so there is no package command to run. Check the device itself.
Open Settings, go to System and updates, then Software update, and see whether an update is waiting. Then compare the installed build against the February 2024 bulletin for your model on the Huawei support site. Exact menu names vary by EMUI release.
For a fleet managed by mobile device management, export the OS build for each Huawei device and flag anything older than the bulletin month. EMUI 12 and 13 devices that no longer receive updates cannot be fixed this way and should be treated as exposed.
What to do now
- Update every affected Huawei phone and tablet to the latest EMUI or HarmonyOS system update.
- Read the February 2024 bulletin entry for this CVE and confirm your model and EMUI version are listed.
- Pull devices that cannot take the update off sensitive networks and data.
- Record the decision in your asset inventory, with the Huawei severity and the NVD score side by side.
Why it matters
A resource reuse bug means memory or another resource is handed to a new user without being cleared, so earlier contents can show through. The stated effect is on confidentiality. Here Huawei rates it higher than NVD does, which is unusual among the entries I read.
NVD lists no exploitation for this CVE and the CISA Known Exploited Vulnerabilities flag in the record is false. Huawei publishes bulletin entries in short form, so details such as the exact trigger are not public. Plan on the information you have and avoid guessing at attack paths.
Quick check
Is CVE-2023-52387 exploited in the wild?
The record shows it is not in the CISA Known Exploited Vulnerabilities catalog, and the bulletin does not say it is exploited. That can change, so check the Gold page for current status.
Why do NVD and Huawei disagree on severity?
NVD reports 7.5, while Huawei labels the entry Critical. Neither source gives its reasoning, so I report both and suggest patching on the higher rating.
Sources
Last reviewed: 19 October 2026.
