Heap Use-After-Free Vulnerability in Android Automotive HAL Service

CVE-2026-58925

What is CVE-2026-58925?

This vulnerability involves a heap use-after-free issue within the android.hardware.automotive.evs-default Hardware Abstraction Layer (HAL) service. It arises due to unsynchronized access to an std::unordered_map, which can occur when an unprivileged application interacts with the EVS manager. By concurrently invoking the setExtendedInfo and getExtendedInfo functions, a malicious actor could potentially execute arbitrary code within the privileged HAL process, leading to serious security implications.

References