This vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList() method. It occurs when an attacker crafts a CameraDesc.metadata byte array that is parsed without validation, causing an out-of-bounds read at an attacker-controlled offset in the heap. This can lead to the exfiltration of sensitive information such as pointers and buffer handles.