CVE-2026-58924

The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then...