CVE-2026-58924

Full vulnerability record from the local CVENow database.

Description

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-02 21:17:35.937000

Last modified

2026-11-02 21:17:35.937000

View original CVE JSON

{
  "id": "CVE-2026-58924",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-02T21:17:35.937",
  "lastModified": "2026-11-02T21:17:35.937",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Google",
          "product": "Android",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "17",
              "status": "affected"
            },
            {
              "version": "16-qpr2",
              "status": "affected"
            },
            {
              "version": "16",
              "status": "affected"
            },
            {
              "version": "15",
              "status": "affected"
            },
            {
              "version": "14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01",
      "source": "[email protected]"
    }
  ]
}