CVEvulnerability

CVE-2024-43093

7.3 HIGH Known exploited Published 2024-11-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Android Framework Privilege Escalation Vulnerability — Android Framework

Android Framework contains an unspecified vulnerability that allows for privilege escalation.

Added to KEV: 2024-11-07
Remediation due: 2024-11-28
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://source.android.com/docs/security/bulletin/2024-11-01 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43093

Status: Analyzed
Published: 2024-11-13
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-176

Description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected configurations

• google android 12.0 • google android 12.1 • google android 13.0 • google android 14.0 • google android 15.0

Weakness · CWE (1)

CWE-176 Improper Handling of Unicode Encoding weakness

References