Live › vulnerability › CVE-2026-58925
The android.hardware.automotive.evs-default HAL service accesses an std::unordered_map without synchronization, so concurrent setExtendedInfo and getExtendedInfo calls can trigger a heap use-after-free. An unprivileged app with access to the EVS manager could use this to potentially run code inside the privileged HAL process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Affects Android Automotive systems that run the EVS default HAL service, where unprivileged apps can reach the EVS manager. Phones and non-automotive Android builds are not described as affected. The sources do not state which versions or builds are vulnerable, so teams should confirm with their Android or OEM vendor.
No product ranges from the sources yet.
android.hardware.automotive.evs-default HAL service (Android Automotive builds)No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The report details a heap Use-After-Free (UAF) vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unordered_map. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to setExtendedInfo and getExtendedInfo, potentially enabling code execution within the privileged HAL process.
This page as .md · .json · in your agent: get_signal("CVE-2026-58925")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.