CVE-2024-57958: Medium Out-of-Bounds Read in Huawei FFRT Module

CVE-2024-57958 is a medium severity flaw (CVSS 5.7) in Huawei's HarmonyOS and EMUI, described as an out-of-bounds array read in the FFRT module. Huawei lists it in its February 2025 security bulletin for phones and tablets. Install the latest system update on affected devices, and check the bulletin for the build that applies to your model.

What's affected

Huawei's bulletin, Security Bulletins for HUAWEI Phones/Tablets, February 2025, lists CVE-2024-57958 as an out-of-bounds array read in the FFRT module. The affected versions it gives are HarmonyOS 5.0.0, 4.3.0, 4.2.0 and 4.0.0, and EMUI 14.0.0. Huawei rates it medium, and says successful exploitation may cause features to perform abnormally.

The bulletin is a monthly security update for flagship models, so the fix arrives as a system update, not as something you install separately. The record lists the products as Huawei EMUI and HarmonyOS. The bulletin does not publish a fixed build number in the line for this CVE, so check your device's update screen and the bulletin for the patch level that covers it.

How to check if you're exposed

Check the system version on each device. In the device settings, the About section shows the HarmonyOS or EMUI version and the security patch level. Compare it with the versions the bulletin names for this CVE: HarmonyOS 5.0.0, 4.3.0, 4.2.0 and 4.0.0, and EMUI 14.0.0.

Then open the system update screen and see whether an update is waiting. If you manage a fleet through a mobile device management system, use its inventory to list OS versions and patch levels across devices, and flag the ones that have not updated since early 2025.

For devices that are older, check whether Huawei still lists them among the models that receive monthly updates. A phone that is no longer supported will not get the fix, and the only real answer is replacement.

What to do now

1. List the Huawei phones and tablets used in your organization, with their HarmonyOS or EMUI versions.
2. Install the latest system update on each, and confirm the patch level afterwards.
3. For managed fleets, set a policy that requires a recent security patch level before a device can access company data.
4. Remove or replace devices that no longer receive updates.
5. Install apps only from trusted stores, because local flaws like this one need code running on the device first.
6. Re-read the bulletin when new months are published, since Huawei releases updates monthly.

Why it matters

The record classes this as CWE-125, out-of-bounds read. The code reads from an array using an index that can fall outside it, so it reads memory it does not own. The result can be a crash or exposure of nearby data.

The vector in the record shows a local attack vector. An attacker needs to run code on the device already, for example through a malicious app, which keeps the score at 5.7. Huawei's description of the impact is cautious, saying features may perform abnormally. The record's KEV flag is false, and the bulletin makes no claim of active exploitation. Memory safety bugs in system modules are fixed through the monthly update cycle, so the practical protection is a current patch level and a careful app policy.

Quick check

Sources

• Huawei Security Bulletins for Phones and Tablets, February 2025

Last reviewed: 19 October 2026.