VULNERABILITY INTELLIGENCE

CVE-2024-43093

CVSS score7.3 HIGH

EPSS probability0.71%

CISA KEVKnown exploited vulnerability

Published2024-11-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Android Framework Privilege Escalation Vulnerability

Vendor / product: Android / Framework

Description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-176

Primary references

security@android.com — Patch
security@android.com — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory, US Government Resource