Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-58925

Google Android: use-after-free can lead to remote code execution

Risk score
48/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.2%
Published
2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
The report details a heap Use-After-Free (UAF) vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unordered_map. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to setExtendedInfo and ge…
Affected
Google Android
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Google AndroidTHE FLAWSTHE FIXCVE-2026-58925Use-after-free can lead toremote code executionCVSS 7.8 · EPSS 0%CVE-2026-58835Heap buffer overflow can leadto remote code executionCVSS 8.8 · EPSS 0%CVE-2026-55280In multiple locations, there is apossible out-of-bounds writedue to uninitialized dataCVSS 8.8 · EPSS 0%CVE-2026-45524Missing authorisationCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGoogle AndroidYELLOW · PLAN IT INGoogle AndroidIn cfg2prop of btif_storage.cc,there is a possibleout-of-bounds write due to aheap buffer overflow. This couldlead to remote code executionwith no additional executionprivileges needed. User…Where it standsNo known exploitationCONNECTS TOSame weaknessUse-after-free (CWE-416)400 other warnings in 30 days →Same productEarlier Google Android warnings41 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Google Android: Yellow, plan it in. In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

The flaws

  • CVE-2026-58925: Use-after-free can lead to remote code execution (CVSS 7.8 · EPSS 0%)
  • CVE-2026-58835: Heap buffer overflow can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-55280: In multiple locations, there is a possible out-of-bounds write due to uninitialized data (CVSS 8.8 · EPSS 0%)
  • CVE-2026-45524: Missing authorisation (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Google Android

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.8 high

References

Original description

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.

Last activity 2 Nov 2026. Patch Forecast updates every hour.