Heap Out-of-Bounds Read Vulnerability in EVS HAL from Android

CVE-2026-58924

What is CVE-2026-58924?

A vulnerability exists in the Android EVS Hardware Abstraction Layer (HAL) within the getStreamList() method. An attacker can exploit this flaw by crafting a malicious CameraDesc.metadata byte array, which is then parsed without proper validation. This flaw allows for an out-of-bounds read operation to occur at a location controlled by the attacker in the process's heap memory. As a result, sensitive information such as pointers and buffer handles may be exposed, enabling potential data leaks to the attacker.

References