CVE-2023-40107

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Android	14; 13; 12L; 12
google	android	12.0; 12.0l; 13.0; 14.0

References

https://android.googlesource.com/platform/frameworks/av/+/acb81624b4f50fed52cb1b3829809ee2f7377093Mailing List, Patch
https://source.android.com/security/bulletin/2023-11-01Patch, Vendor Advisory
https://android.googlesource.com/platform/frameworks/av/+/acb81624b4f50fed52cb1b3829809ee2f7377093Mailing List, Patch
https://source.android.com/security/bulletin/2023-11-01Patch, Vendor Advisory

Timeline

Published: Feb 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-401085.5In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This cou CVE-2023-401097.8In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could l CVE-2023-40117.5An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource c CVE-2023-401107.8In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local esca CVE-2023-401117.8In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a c CVE-2023-401125.5In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl CVE-2023-401135.5In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could lead CVE-2023-401147.8In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could lead to local escala CVE-2023-401157.8In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privi CVE-2023-401167.8In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error i CVE-2023-401177.8In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local CVE-2023-40127.5ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).