AIKIDO-2026-776928

TL;DR

The native audio recorder callback on Android and iOS forwards the operating-system-owned capture buffer directly to a worker thread through an asynchronous offloader. The operating system reclaims that buffer once the synchronous callback returns, so the offloader thread reads and processes memory that has already been freed. This use-after-free can crash the application or expose stale heap contents whenever audio recording is active. The fix copies the callback audio data into an owned buffer before the async handoff and frees that copy after the worker thread finishes processing it.