CVE-2024-43093

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43093
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10 Patch
https://source.android.com/security/bulletin/2025-03-01 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
History

23 Oct 2025, 14:52

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093 - Third Party Advisory, US Government Resource

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:20

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093 -

16 Sep 2025, 14:07

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 7.3

15 Sep 2025, 21:15

Type Values Removed Values Added
CWE CWE-176

27 Aug 2025, 14:26

Type Values Removed Values Added
CPE cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
References () https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10 - () https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10 - Patch
References () https://source.android.com/security/bulletin/2025-03-01 - () https://source.android.com/security/bulletin/2025-03-01 - Vendor Advisory

26 Aug 2025, 23:15

Type Values Removed Values Added
References
  • {'url': 'https://android.googlesource.com/platform/frameworks/base/+/67d6e08322019f7ed8e3f80bd6cd16f8bcb809ed', 'tags': ['Patch'], 'source': 'security@android.com'}
  • {'url': 'https://source.android.com/security/bulletin/2024-11-01', 'tags': ['Vendor Advisory'], 'source': 'security@android.com'}
  • () https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10 -
  • () https://source.android.com/security/bulletin/2025-03-01 -
Information

Published : 2024-11-13 18:15

Updated : 2025-10-23 14:52

NVD link : CVE-2024-43093

Mitre link : CVE-2024-43093

CVE.ORG link : CVE-2024-43093

JSON object : View

Products Affected

google

  • android
CWE
CWE-176

Improper Handling of Unicode Encoding