{"id":"CVE-2026-58925","kind":"vulnerability","aliases":["CVE-2026-58925"],"related":[],"title":"Android automotive EVS HAL: concurrent calls cause use-after-free, enabling code execution","description":"The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.","summary":"The android.hardware.automotive.evs-default HAL service accesses an std::unordered_map without synchronization, so concurrent setExtendedInfo and getExtendedInfo calls can trigger a heap use-after-free. An unprivileged app with access to the EVS manager could use this to potentially run code inside the privileged HAL process.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","automotive","evs","hal","infrastructure"],"not_affected_if":["no-evs-hal","non-automotive-android"],"how_to_check":"- Check whether the device or build includes the `android.hardware.automotive.evs-default` HAL service (Android Automotive builds)\n- Confirm the build's security patch level against the vendor's bulletin: unknown","fix":null,"status":"open","published_at":"2026-11-02T21:17:36+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:14+00:00","updated_at":"2026-11-02T21:37:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T21:37:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android automotive EVS HAL: concurrent calls cause use-after-free, enabling code execution","impact":"high","summary":"The android.hardware.automotive.evs-default HAL service accesses an std::unordered_map without synchronization, so concurrent setExtendedInfo and getExtendedInfo calls can trigger a heap use-after-free. An unprivileged app with access to the EVS manager could use this to potentially run code inside the privileged HAL process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["android","automotive","evs","hal"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Unprivileged app runs code inside privileged automotive HAL process","analyst_note":"Find affected Android versions and the vendor patch status from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-58925) and the AOSP security bulletin.","how_to_check":"- Check whether the device or build includes the `android.hardware.automotive.evs-default` HAL service (Android Automotive builds)\n- Confirm the build's security patch level against the vendor's bulletin: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["non-automotive-android","no-evs-hal"],"who_is_affected":"Affects Android Automotive systems that run the EVS default HAL service, where unprivileged apps can reach the EVS manager. Phones and non-automotive Android builds are not described as affected. The sources do not state which versions or builds are vulnerable, so teams should confirm with their Android or OEM vendor.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4165,"output_tokens":612,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-58925':17A,20A 'access':31B,56B,93C,103C 'android':1A,21B 'android.hardware.automotive.evs':27B,86C 'app':54B 'applic':101C 'automot':2A,22B 'call':6A,43B,115C 'caus':7A 'code':13A,67B,122C 'concurr':5A,39B,114C 'could':61B 'cve':15A,18A 'default':28B,87C 'detail':75C 'enabl':12A,121C 'ev':3A,23B,59B,106C 'execut':14A,123C 'free':11A,51B,81C 'getextendedinfo':42B,119C 'hal':4A,24B,29B,71B,88C,127C 'heap':47B,77C 'infrastructur':25B 'insid':68B 'make':113C 'manag':60B,107C 'map':35B,98C 'potenti':65B,120C 'privileg':70B,126C 'process':72B,128C 'report':74C 'run':66B 'servic':30B,89C 'setextendedinfo':40B,117C 'std':33B,96C 'stem':90C 'synchron':37B 'trigger':45B,109C 'uaf':82C,111C 'unord':34B,97C 'unprivileg':53B,100C 'unsynchron':92C 'use':9A,49B,62B,79C 'use-after-fre':8A,48B,78C 'vulner':83C 'within':84C,124C 'without':36B","nicknames":[],"mitigations":[],"who_affected":"Affects Android Automotive systems that run the EVS default HAL service, where unprivileged apps can reach the EVS manager. Phones and non-automotive Android builds are not described as affected. The sources do not state which versions or builds are vulnerable, so teams should confirm with their Android or OEM vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","automotive","evs","hal","infrastructure","unknown"],"first_public_at":"2026-11-02T21:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58925","severity":null,"published_at":"2026-11-02T21:17:36+00:00","modified_at":"2026-11-02T21:17:36+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}