CVE-2024-0042

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protection with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Google	Android	Android SoC
google	android	soc

References

https://source.android.com/security/bulletin/2024-04-01Vendor Advisory
https://source.android.com/security/bulletin/2024-04-01Vendor Advisory

Timeline

Published: May 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-00437.8In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the cod CVE-2024-00446.7In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could le CVE-2024-00456.5In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proxi CVE-2024-00467.8In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the cod CVE-2024-00475.5In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could CVE-2024-00487.8In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of nu CVE-2024-00497.8In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privile CVE-2024-00507.8In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead CVE-2024-00517.8In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalatio CVE-2024-00523.3In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lea CVE-2024-00533.3In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This coul CVE-2024-00546.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cgi and irissetup.cgi w