CVE-2024-43093

high · 7.3Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-11-07Remediation due 2024-11-28

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

7.3

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2024-11-13

Published

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-176

Affected products

Vendor	Product	Affected versions
google	android	12.0
google	android	12.1
google	android	13.0
google	android	14.0
google	android	15.0

Check a specific version with /api/v1/cve/match.

References

https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10
https://source.android.com/security/bulletin/2025-03-01
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-43093