Security-bulletin

security@openharmony.io

October 2026

1 participants
1 discussions

2026年10月安全公告
by 王晨 13 Oct '26

13 Oct '26

2026年10月安全漏洞发布于2026.10.01 最后更新于2026.10.01 备注：OpenHarmony-5.0.3-Release分支当前已停止维护，后续这个分支的安全漏洞也不再维护，详情参见社区公告。 OpenHarmony-5.0.3-Release分支停止维护公告 CVE漏洞描述漏洞影响严重程度CVSS3.1基础得分受影响的版本受影响的仓库修复链接 CVE-2026-69668drivers_peripheral 竞争条件漏洞本地攻击者可造成DOS低危3.3OpenHarmony-6.0-Releasedrivers_peripheral6.0.x CVE-2026-67562device_soc_rockchip 内存泄露漏洞本地攻击者可造成DOS低危3.3OpenHarmony-5.1.0-Release OpenHarmony-6.0-Releasedevice_soc_rockchip6.0.x 5.1.0.x CVE-2026-67584drivers_hdf_core 竞争条件漏洞本地攻击者可造成任意代码执行中危6.5OpenHarmony-5.1.0-Release OpenHarmony-6.0-Release OpenHarmony-6.1-LTSdrivers_hdf_core6.0.x 5.1.0.x 6.1.x-LTS CVE-2026-82565drivers_peripheral 失败路径未回滚漏洞本地攻击者可造成DOS低危3.3OpenHarmony-6.1-LTSdrivers_peripheral6.1.x-LTS CVE-2026-81641drivers_peripheral 失败路径未回滚漏洞本地攻击者可造成DOS低危3.3OpenHarmony-5.1.0-Release OpenHarmony-6.0-Releasedrivers_peripheral6.0.x 5.1.0.x 以下为三方库漏洞，只提供CVE、严重程度、受影响的OpenHarmony版本，详细信息请参考三方公告。 CVE严重程度CVSS 3.1得分受影响的仓库受影响的OpenHarmony版本修复链接 CVE-2026-8932无尚未提供third_party_curlOpenHarmony-6.0-Release6.0.x CVE-2026-8924无尚未提供third_party_curlOpenHarmony-6.0-Release6.0.x CVE-2026-8458无尚未提供third_party_curlOpenHarmony-6.0-Release6.0.x CVE-2026-7168中危4.3third_party_curlOpenHarmony-6.0-Release6.0.x CVE-2026-64835高危8.8third_party_ffmpegOpenHarmony-6.1-LTS6.1.x-LTS CVE-2026-64833高危7.1third_party_ffmpegOpenHarmony-6.1-LTS6.1.x-LTS CVE-2026-6429低危3.1third_party_curlOpenHarmony-6.0-Release6.0.x CVE-2026-6253中危4.3third_party_curlOpenHarmony-6.0-Release6.0.x CVE-2026-58055中危5.4third_party_nghttp2OpenHarmony-6.0-Release OpenHarmony-6.1-LTS6.0.x 6.1.x-LTS CVE-2026-17914无尚未提供third_party_skiaOpenHarmony-6.1-LTS6.1.x-LTS CVE-2026-14266高危7third_party_lzmaOpenHarmony-6.1-LTS6.1.x-LTS 以下是各维护版本的安全补丁标签，请在合入当月及之前全部对应安全补丁之后，更新安全补丁标签。对应维护版本安全补丁修改方式参考链接 6.1.x-LTShttps://gitcode.com/openharmony/startup_init/pull/4958 6.0.xhttps://gitcode.com/openharmony/startup_init/pull/4957 5.1.0.xhttps://gitcode.com/openharmony/startup_init/pull/4956

1 0