Improper input validation in Google Android - CVE-2024-43093
Published: November 4, 2024 / Updated: March 3, 2025
Vulnerability identifier: #VU99699
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-43093
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper input validation within the Framework Documents UI component. A local application can execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Google Android
Samsung Mobile Firmware
Samsung Mobile Firmware
How to mitigate CVE-2024-43093
Install security update from vendor's website.
Google Android - addressed in versions 12 2024-11-01, 13 2024-11-01, 14 2024-11-01, 15 2024-11-01
Samsung Mobile Firmware - update to SMR-MAR-2025
Samsung Mobile Firmware - update to SMR-MAR-2025