Description
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
Published: 2026-11-02
Score: 2.5 Low
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Android EVS HAL Enables File Descriptor Leakage for Privileged Clients

Tue, 03 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Mon, 02 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Android EVS HAL Enables File Descriptor Leakage for Privileged Clients
First Time appeared Google
Google android
Weaknesses CWE-362
CWE-416
Vendors & Products Google
Google android

Mon, 02 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Description A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-11-03T18:59:25.842Z

Reserved: 2026-07-02T06:12:52.307Z

Link: CVE-2026-58926

cve-icon Vulnrichment

Updated: 2026-11-03T18:59:18.414Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-02T21:17:36.150

Modified: 2026-11-03T19:18:07.053

Link: CVE-2026-58926

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T22:00:05Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free