The flaw is a use‑after‑free in the EVS AIDL HAL. A data race on an unsynchronised weak_ptr inside EvsEnumerator::openCamera can tear the pointer state when concurrent calls are made from a privileged UID such as AID_AUTOMOTIVE_EVS. The corrupted weak_ptr causes a virtual call through a freed object's vtable, which can lead to arbitrary code execution in the hal_evs_default process.

Android Automotive devices that implement the EVS AIDL HAL, particularly the hal_evs_default service. No specific version information is supplied in the CVE record.

An attacker with the privileged AID_AUTOMOTIVE_EVS UID could invoke concurrent openCamera calls and trigger arbitrary code execution inside the hal_evs_default process. EPSS is not available and the flaw is not listed in CISA KEV, which does not reduce the seriousness of a defect that enables arbitrary code execution.