CVE-2025-54617 is a medium severity (CVSS 6.8) stack based buffer overflow in the dms_fwk module of Huawei HarmonyOS. The record says successful exploitation can cause remote code execution. Check Huawei's August 2025 security bulletin and install the matching update. The sections below cover who is affected, how to check, and what to do first.
What's affected
- Huawei HarmonyOS is the affected product in the record.
- The record does not list affected versions or fixed builds. Huawei's 2025 August security bulletin is the place to confirm them for your device.
The record lists CVSS 6.8 (Medium). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
On the device, open Settings and read the system version, then compare it with the build named in the Huawei August 2025 security bulletin for your model. Turn on automatic system updates.
What to do now
- Open the Huawei security bulletin for August 2025 and find your device model.
- Install the latest system update.
- Enable automatic updates.
- For managed fleets, record which devices have not updated.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-121, stack based buffer overflow. A write past the end of a stack buffer can overwrite control data, which is why the record mentions code execution.
The record gives very little beyond that, so this post stays at that level. The score of 6.8 suggests conditions beyond a simple network request. The record does not flag KEV status.
Severity scores are a starting point. The score for this entry is 6.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Which HarmonyOS versions are fixed?
The record does not say. Check the Huawei bulletin for your model.
Is it exploited in the wild?
The record does not flag it as KEV.
Sources
Last reviewed: 18 October 2026.
