CVE-2024-43093 kev in the critical feed json
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensi…
published 2024-11-13 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-40034
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-11-07
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Timeline
- 0-day patched (Project Zero)
- Added to CISA KEV
- Published
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-11-28 (23 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Android, Framework
- CISA name
- Android Framework Privilege Escalation Vulnerability
Zero-day
Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.
- Patched
- 2024-11-04
- Details
- project zero tracker
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected products
- Google Android
Classification
- Weakness
-
- CWE-176 Improper Handling of Unicode Encoding
References
-
android.googlesource.com
/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10
patch
-
source.android.com
/security/bulletin/2025-03-01
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093
government-resource, third-party-advisory, us-government-resource
Sources
- CVE List CVE-2024-43093
- NVD CVE-2024-43093
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.