CVE-2026-58925: Use After Free

Published Nov 2, 2026

Updated

The report details a heap Use-After-Free (UAF) vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unorderedmap. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to setExtendedInfo and getExtendedInfo, potentially enabling code execution within the privileged HAL process.

Event History

Nov 2, 2026

CVE Published

via NVD·09:17 PM

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An unprivileged application that has access to the EVS manager can trigger the vulnerability. The affected component is the android.hardware.automotive.evs-default HAL service.

What actions are required to trigger the use-after-free condition?

The attacker must make concurrent calls to setExtendedInfo and getExtendedInfo. The flaw results from unsynchronized access to an std::unordered_map.

What is the potential impact of successful exploitation?

Successful exploitation may enable code execution in the privileged HAL process.

CVE-2026-58925: Use After Free

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions are required to trigger the use-after-free condition?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions are required to trigger the use-after-free condition?

What is the potential impact of successful exploitation?