A Use-After‑Free flaw exists in the EVS HAL of Android where a privileged client can call doneWithFrame and setMaxFramesInFlight, freeing a buffer_handle_t while a producer thread is still accessing it. The resulting race condition allows the attacker to control corrupted heap memory, potentially causing the EVS HAL process to expose file descriptors and other internal data. The vulnerability is a classic memory corruption that can be exploited in a privilege‑bound context.

The issue impacts Android devices that include the EVS HAL component. All devices running Android with an unpatched EVS HAL are potentially affected; no specific OS version or build identifier is provided in the advisory.

The flaw requires a privileged client, limiting the attack surface to apps or processes that already have elevated permissions on the device. No public exploits or evidence of remote exploitation are reported. The CVSS score is 2.5, indicating a low severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating that an active, known exploitation is not publicly documented at this time.