CVE-2026-58926

Unknown

Published: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a buffer_handle_t while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.

Risk Assessment

A privileged client could cause leakage of file descriptors from the HAL process, potentially facilitating further attacks. This requires privileged access.

Recommendation

Update the EVS HAL to a version with synchronization fixes in doneWithFrame and setMaxFramesInFlight. Restrict access to the EVS HAL to trusted clients only.

Other vulnerabilities in EVS HAL

CVE-2026-58924Unknown
The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList() method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

Original NVD description (English source)

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS