CVE-2024-3759 is a medium severity vulnerability (CVSS 6.5) in OpenHarmony. A use after free allows a local attacker to run arbitrary code in the trusted computing base (TCB). The record cites the OpenHarmony May 2024 security disclosure. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- OpenHarmony v4.0.0 and prior versions, according to the record.
Severity in the record: Medium, CVSS 6.5, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. In plain terms: with local access, low privileges required, no user interaction. Weakness class: CWE-416, use after free.
Fixed version: The record cites the OpenHarmony May 2024 security disclosure. Check that bulletin for the fixed release and the patch for your device branch.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Find your OpenHarmony version in the device system information or your vendor's build metadata.
- Compare it with the version named in the May 2024 OpenHarmony security disclosure.
What to do now
- Update to the fixed version and restart the application so the new build is actually running.
- Keep automatic updates enabled.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3759.
Why it matters
A use after free bug is a memory safety error. The program releases a block of memory, keeps a pointer to it, and later uses that pointer. By then the memory may hold something else, so the program can read or write data it does not own. In a browser, bugs like this are a common route to code execution, which is why they are patched quickly.
The record lists this next to a heap overflow disclosed in the same bulletin. If you track OpenHarmony based devices, treat the two together and verify both patches are present. The attacker must be local, so device hardening and app vetting reduce the chance of the first step.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
What is the TCB?
The trusted computing base is the part of the system that enforces security rules. Code running there has the highest privilege, which is why memory bugs in it are rated seriously.
Is CVE-2024-3759 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
