CVE-2024-3758 is a medium severity vulnerability (CVSS 6.5) in OpenHarmony. A heap buffer overflow lets a local attacker run arbitrary code in the trusted computing base (TCB). The record cites the OpenHarmony May 2024 security disclosure. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- OpenHarmony v4.0.0 and prior versions, according to the record.
Severity in the record: Medium, CVSS 6.5, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. In plain terms: with local access, low privileges required, no user interaction. Weakness class: CWE-122, CWE-787, heap-based buffer overflow and out-of-bounds write.
Fixed version: The record cites the OpenHarmony May 2024 security disclosure. Check that bulletin for the fixed release and the patch for your device branch.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Find your OpenHarmony version in the device system information or your vendor's build metadata.
- Compare it with the version named in the May 2024 OpenHarmony security disclosure.
What to do now
- Update to the fixed version and restart the application so the new build is actually running.
- Keep automatic updates enabled.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3758.
Why it matters
A use after free bug is a memory safety error. The program releases a block of memory, keeps a pointer to it, and later uses that pointer. By then the memory may hold something else, so the program can read or write data it does not own. In a browser, bugs like this are a common route to code execution, which is why they are patched quickly.
A heap overflow writes past the end of an allocated block and can overwrite neighboring data. Code in the trusted computing base is the most privileged part of the system, so a local bug that reaches it matters even though the attacker must already have a foothold on the device. Device makers that ship OpenHarmony based products decide when the fix reaches users.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Can this be exploited remotely?
The record says a local attacker. An attacker needs to run code on the device first, so this is mostly a privilege escalation concern.
Is CVE-2024-3758 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
