6 matches found
EUVD-2026-115620
A Use-After-Free UAF vulnerability exists in the EVS HAL, allowing a privileged client to free a bufferhandlet while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially...
CVE-2026-58926
A Use-After-Free (UAF) vulnerability exists in the EVS HAL , where a privileged client can free a buffer_handle_t while the producer thread is still actively using it. This race condition is triggered via the doneWithFrame and setMaxFramesInFlight functions. An attacker can exploit this to manipu...
CVE-2026-58924
The EVS HAL is vulnerable to a heap out-of-bounds read within the getStreamList() method. The root cause is the lack of validation when parsing a CameraDesc.metadata byte array, allowing an attacker to trigger a read at an attacker-controlled offset within the HAL process's heap. This can result ...
EUVD-2026-115618
The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then...
CVE-2026-58926: Google Android: A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t`…
A Use-After-Free UAF vulnerability exists in the EVS HAL, allowing a privileged client to free a bufferhandlet while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially...
CVE-2026-58924: Google Android: The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method
The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then...