Use-After-Free Vulnerability in EVS HAL Affecting Android Devices

CVE-2026-58926

What is CVE-2026-58926?

A Use-After-Free (UAF) vulnerability has been identified in the EVS HAL of Android devices. This issue allows a privileged client to improperly free a buffer_handle_t while it remains in use by the producer thread. The race condition can be exploited through specific function calls, such as doneWithFrame and setMaxFramesInFlight. As a result, an attacker could manipulate freed heap memory, potentially leading to unintended file descriptor leaks from the EVS HAL process.

References