CVE-2026-58925

Received Received - Intake

Heap Use-After-Free in Android Automotive EVS HAL

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-02

Last Modified

2026-11-02

Generated

2026-11-03

AI Q&A

2026-11-03

EPSS Evaluated

N/A

NVD

CVE-2026-58925

Affected Vendors & Products

Vendor	Product	Version / Range
Google	Android	17
Google	Android	16-qpr2
Google	Android	16
Google	Android	15
Google	Android	14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap Use-After-Free (UAF) vulnerability in the android.hardware.automotive.evs-default HAL service. It occurs due to unsynchronized access to an std::unordered_map. An unprivileged app with EVS manager access can trigger UAF by making concurrent calls to setExtendedInfo and getExtendedInfo, potentially allowing code execution in the privileged HAL process.

Impact Analysis

An attacker could exploit this to execute arbitrary code within a privileged process, potentially gaining control over system functions. This may lead to unauthorized data access, system instability, or privilege escalation on affected Android Automotive systems.

Mitigation Strategies

Apply the latest Android security patches to address the heap Use-After-Free vulnerability in the android.hardware.automotive.evs-default HAL service. Restrict unprivileged applications from accessing the EVS manager to prevent concurrent calls to setExtendedInfo and getExtendedInfo.

Hi! I’m here to help you understand CVE-2026-58925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...