CVE-2026-58924

Unknown

Published: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList() method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

Risk Assessment

An attacker could leak sensitive information from the HAL process, including pointers and buffer handles, potentially facilitating further attacks. This may lead to bypassing security mitigations.

Recommendation

Update the EVS HAL to a version that validates CameraDesc.metadata in getStreamList(). Restrict access to the EVS HAL to trusted clients only.

Other vulnerabilities in EVS HAL

CVE-2026-58926Unknown
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a buffer_handle_t while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.

Original NVD description (English source)

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS