CVE-2024-0048

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-230

Affected software

Vendor	Product	Versions
Google	Android	14; 13; 12L; 12
google	android	12.0; 12l; 13.0; 14.0

References

https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eedeMailing List, Patch
https://source.android.com/security/bulletin/2024-03-01Patch, Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eedeMailing List, Patch
https://source.android.com/security/bulletin/2024-03-01Patch, Vendor Advisory

Timeline

Published: Mar 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-00497.8In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privile CVE-2024-00507.8In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead CVE-2024-00517.8In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalatio CVE-2024-00523.3In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lea CVE-2024-00533.3In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This coul CVE-2024-00546.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cgi and irissetup.cgi w CVE-2024-00556.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file CVE-2024-00568.7Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability CVE-2024-00579.8NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability CVE-2024-00665.3Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Ax CVE-2024-00674.3Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks all CVE-2024-00687.1Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows File Manipulation.This