{"id":"CVE-2026-58927","kind":"vulnerability","aliases":["CVE-2026-58927"],"related":[],"title":"Android EVS camera HAL: data race lets privileged app run code","description":"The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process.","summary":"A data race in the Android EVS AIDL camera HAL lets concurrent calls from a privileged automotive UID free an object still in use. The freed object's virtual call can then lead to arbitrary code execution inside the hal_evs_default process.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","automotive","evs-hal","runtime"],"not_affected_if":["no-evs-hal","non-automotive-build"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T21:17:36+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:12+00:00","updated_at":"2026-11-02T21:37:12+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T21:37:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android EVS camera HAL: data race lets privileged app run code","impact":"high","summary":"A data race in the Android EVS AIDL camera HAL lets concurrent calls from a privileged automotive UID free an object still in use. The freed object's virtual call can then lead to arbitrary code execution inside the hal_evs_default process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["android","automotive","evs-hal"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs inside the camera HAL process","analyst_note":"Check the NVD entry and Android security bulletin for affected versions and the patched build; confirm whether the EVS HAL is reachable from apps or only privileged UIDs.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-evs-hal","non-automotive-build"],"who_is_affected":"Affects the Android EVS camera HAL (hal_evs_default) on devices that expose the EVS service, typically automotive builds where the AID_AUTOMOTIVE_EVS UID is used. The sources do not say which Android versions or builds are affected, nor which devices ship this service. Systems without the EVS HAL are not exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4228,"output_tokens":495,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58927':14A,17A 'aid':103C 'aidl':31B,79C 'allow':129C 'android':1A,18B,29B 'app':9A 'arbitrari':58B,132C 'aris':81C 'automot':19B,40B,104C 'call':36B,53B,97C,117C 'camera':3A,32B 'cameraobj':125C 'caus':107C 'code':11A,59B,133C 'concurr':35B,96C 'cve':12A,15A 'data':5A,25B,84C 'default':65B,139C 'desc':127C 'e.g':102C 'ev':2A,21B,30B,64B,78C,105C,138C 'evs-hal':20B 'evsenumer':93C 'execut':60B,134C 'free':42B,74C 'freed':49B,120C 'getcamerainfo':126C 'hal':4A,22B,33B,63B,80C,137C 'insid':61B 'lead':56B,113C 'let':7A,34B 'object':44B,50B,121C 'opencamera':94C 'potenti':131C 'privileg':8A,39B,100C 'process':66B,140C 'ptr':91C,111C 'race':6A,26B,85C 'run':10A 'runtim':23B 'specif':95C 'state':112C 'std':89C 'still':45B 'torn':109C 'uaf':75C 'uid':41B,101C 'unsynchron':88C 'use':47B,72C 'use-after-fre':71C 'virtual':52B,116C 'vtabl':123C 'vulner':68C 'weak':90C,110C 'within':92C,135C","nicknames":[],"mitigations":[],"who_affected":"Affects the Android EVS camera HAL (hal_evs_default) on devices that expose the EVS service, typically automotive builds where the AID_AUTOMOTIVE_EVS UID is used. The sources do not say which Android versions or builds are affected, nor which devices ship this service. Systems without the EVS HAL are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","automotive","evshal","runtime","unknown"],"first_public_at":"2026-11-02T21:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58927","severity":null,"published_at":"2026-11-02T21:17:36+00:00","modified_at":"2026-11-02T21:17:36+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}