CVE-2026-58926: Use After Free
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a bufferhandlet while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
Exploitation requires local access and low privileges. The attacker must be able to act as a privileged EVS client and invoke the relevant frame-handling operations.
What conditions are required to trigger the race?
The attacker needs to free a buffer_handle_t while the producer thread still uses it. The race is triggered through doneWithFrame and setMaxFramesInFlight.
What is the likely impact if exploitation succeeds?
Successful exploitation may allow manipulation of freed heap memory and leakage of file descriptors from the EVS HAL process. The provided impact information indicates confidentiality impact only, with no stated integrity or availability impact.