The report details a heap Use-After-Free (UAF) vulnerability within the "android.hardware.automotive.evs-default" HAL service, stemming from unsynchronized access to an "std::unordered_map". An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to "setExtendedInfo" and "getExtendedInfo", potentially enabling code execution within the privileged HAL process.