The Android EVS HAL processes a CameraDesc.metadata byte array in getStreamList() without validating its bounds. This oversight triggers a heap‑out‑of‑bounds read that an attacker can exploit by crafting a malicious payload. The HAL then leaks the contents of the host process’s heap—including pointers and buffer handles—back to the attacker, enabling sensitive information disclosure and potentially aiding further attacks.

Google Android devices that contain the EVS HAL component are impacted. Any Android build that includes the standard EVS HAL processor can be vulnerable, as the flaw resides within the HAL layer of the camera framework. No specific Android version or model was listed in the data, but all installations of the EVS HAL are affected.

The vulnerability requires delivery of a crafted CameraDesc.metadata payload, which can be achieved by a local application with camera access. While it does not allow remote code execution or direct privilege escalation, the ability to read arbitrary heap contents presents a high‑severity flaw. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog. Nonetheless, the potential for sensitive data leakage warrants immediate attention.