CVE-2024-34637

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-346387.1Improper handling of exceptional conditions in ThemeCenter prior to SMR Sep-2024 Release 1 allows local attackers to delete non-preloaded apCVE-2024-346394.6Improper handling of exceptional conditions in Setupwizard prior to SMR Aug-2024 Release 1 allows physical attackers to bypass proper validaCVE-2024-34649.8A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporaCVE-2024-346403.3Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of prCVE-2024-346413.3Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuCVE-2024-346424.6Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information.CVE-2024-346435.5Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protecteCVE-2024-346445.5Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected daCVE-2024-346454.6Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privileged applications.CVE-2024-346465.5Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local permanent denial of serCVE-2024-346475.5Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs relaCVE-2024-346485.5Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive d
CVE-2024-34637: Medium severity, CVSS 5.5 | Vulnix