CVE-2026-58925

The report details a heap Use-After-Free (UAF) vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unordered map. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to setExtendedInfo and getExtendedInfo, potentially enabling code execution within the privileged HAL process.