The Android EVS HAL service contains a heap Use-After-Free vulnerability caused by unsynchronized access to an std::unordered_map. A concurrent call to setExtendedInfo and getExtendedInfo from an unprivileged application with EVS manager access can trigger this UAF, potentially allowing the attacker to execute arbitrary code within the privileged HAL process. The weakness is a classic Use-After-Free, corresponding to CWE-416.

Google Android devices running the android.hardware.automotive.evs-default HAL service are affected. The vulnerability targets the EVS manager HAL, specifically the setExtendedInfo and getExtendedInfo APIs, and applies to any device where unprivileged applications can obtain EVS manager permissions.

The absence of a publicly available CVSS score prevents an exact numerical severity rating, yet the vulnerability permits an unprivileged application to gain privilege escalation by executing code in the privileged HAL process. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, attackers would need the EVS manager permission, typically granted only to system applications; any misconfiguration that exposes this permission to third‑party apps can enable an attacker to trigger the UAF. The overall risk is elevated due to the full‑system privileges of the HAL process and the potential for code execution.