Description
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
Published: 2026-11-02
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Android EVS HAL Enables File Descriptor Leakage for Privileged Clients
First Time appeared Google
Google android
Weaknesses CWE-362
CWE-416
Vendors & Products Google
Google android

Mon, 02 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Description A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-11-02T20:21:12.920Z

Reserved: 2026-07-02T06:12:52.307Z

Link: CVE-2026-58926

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T21:17:36.150

Modified: 2026-11-02T21:17:36.150

Link: CVE-2026-58926

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T22:15:17Z

Weaknesses

No weakness.