Live › vulnerability › CVE-2026-58927
A data race in the Android EVS AIDL camera HAL lets concurrent calls from a privileged automotive UID free an object still in use. The freed object's virtual call can then lead to arbitrary code execution inside the hal_evs_default process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Affects the Android EVS camera HAL (hal_evs_default) on devices that expose the EVS service, typically automotive builds where the AID_AUTOMOTIVE_EVS UID is used. The sources do not say which Android versions or builds are affected, nor which devices ship this service. Systems without the EVS HAL are not exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized std::weak_ptr within EvsEnumerator::openCamera(). Specifically, concurrent calls from a privileged UID (e.g., AID_AUTOMOTIVE_EVS) can cause a torn weak_ptr state, leading to a virtual call through a freed object's vtable at cameraObj->getCameraInfo(&desc). This allows for potential arbitrary code execution within the hal_evs_default process.
This page as .md · .json · in your agent: get_signal("CVE-2026-58927")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.