{"id":"CVE-2026-58926","aliases":["EUVD-2026-115620","GHSA-j652-wcpg-cqmf"],"status":"published","title":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free...","description":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00069,"percentile":0.00029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362","CWE-416"],"published":"2026-11-02T20:21:12Z","modified":"2026-11-04T19:45:22Z","products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58926"},{"url":"https://github.com/advisories/GHSA-j652-wcpg-cqmf"}],"sources":{"cve":[{"id":"CVE-2026-58926","description":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","status":"published","published":"2026-11-02T20:21:12.92Z","modified":"2026-11-03T18:59:25.842Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-416","CWE-362"],"updated_at":"2026-11-03T20:02:17.561698Z"}],"euvd":[{"id":"EUVD-2026-115620","description":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","status":"published","published":"2026-11-02T20:21:12Z","modified":"2026-11-03T18:59:25Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T20:20:08.057916Z"}],"ghsa":[{"id":"GHSA-j652-wcpg-cqmf","title":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free...","description":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","status":"published","published":"2026-11-02T21:32:06Z","modified":"2026-11-03T21:32:03Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-362"],"updated_at":"2026-11-03T21:34:06.482208Z"}],"nvd":[{"id":"CVE-2026-58926","description":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","status":"published","published":"2026-11-02T21:17:36.15Z","modified":"2026-11-04T19:45:22.08Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-362","CWE-416"],"updated_at":"2026-11-04T21:42:34.407483Z"}]}}