# CVE-2026-58927: Android EVS AIDL HAL use-after-free in openCamera

Source: https://junglewise.ai/threats/cve-2026-58927-the-vulnerability-is-a-use-after-free-uaf-in-the-evs-aidl-hal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-58927 · Severity: info · Published 2026-11-02

Android Automotive OS's Electronic Stability Control (EVS) system has a memory safety flaw that can be triggered by privileged applications. An attacker with access to the EVS service could potentially execute arbitrary code within the EVS process, compromising vehicle infotainment and control systems.

Technologies: [Google Android](https://junglewise.ai/threats/technologies/android), [Google Android Automotive OS](https://junglewise.ai/threats/technologies/android-automotive-os). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-58927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58927 being exploited in the wild.

**How severe is CVE-2026-58927?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Google Android 14, 15, 16, 16-qpr2, 17; Google Android Automotive OS 14, 15, 16, 16-qpr2, 17.

**Is there a fix for CVE-2026-58927?** Yes: fixed in Android 14, 15, 16, 16-qpr2, 17 (2026-11-01 security patch level). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58927 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-58927?** Check whether you run Google Android or Google Android Automotive OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Android 14, 15, 16, 16-qpr2, 17 (2026-11-01 security patch level)

## Technical details

A use-after-free vulnerability exists in EvsEnumerator::openCamera() due to an unsynchronized std::weak_ptr that creates a data race condition. Concurrent calls from a privileged UID can cause a torn weak_ptr state, leading to a virtual function call through a freed object's vtable, enabling code execution in the hal_evs_default process.

## Affected products

- Google Android 14, 15, 16, 16-qpr2, 17
- Google Android Automotive OS 14, 15, 16, 16-qpr2, 17

## Timeline

- 2026-11-02: disclosed
- 2026-11-02: advisory: Android Automotive OS security bulletin published

## References

- [https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01](https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01)

## Related threats

- [Google Android Bluetooth buffer overflow in acquireMemory](https://junglewise.ai/threats/cve-2026-95405-in-acquirememory-of-bt-bqr-offload-cc-there-is-a-possible-way-to)
- [ST NFC HAL out-of-bounds write in global memory](https://junglewise.ai/threats/cve-2026-95400-in-stnfc-hal-write-of-hal-st21nfc-cc-there-is-a-possible-way-to)
- [Android HEVC decoder buffer overflow in sub_layer_hrd_parameters](https://junglewise.ai/threats/cve-2026-95397-in-sub-layer-hrd-parameters-of-hevc-decoder-there-is-a-possible)
- [Android framework memory exhaustion in message queue handling](https://junglewise.ai/threats/cve-2026-59632-in-respondreceivedmessage-of-mtsmessagecontroller-cpp-there-is-a)
- [Android use-after-free in UssiController connection listener](https://junglewise.ai/threats/cve-2026-59626-in-sendinfo-of-ussicontroller-cpp-there-is-a-possible-way-to)