CVE-2024-40662

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-406646.2In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logiCVE-2024-406698.4In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additionCVE-2024-40675.3The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micrCVE-2024-406708.4In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additionCVE-2024-406717.8In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission cheCVE-2024-406728.4In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This couCVE-2024-406736.5In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to impCVE-2024-406745.3In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the cCVE-2024-406757.5In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of sCVE-2024-406767.7In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to aCVE-2024-406778.4In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing peCVE-2024-406795.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive
CVE-2024-40662: High severity, CVSS 7.8 | Vulnix