CVE-2024-43088

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missing permission check. This could lead to local escalation of privilege across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Google	Android	15; 14; 13; 12L; 12
google	android	12.0; 12l; 13.0; 14.0; 15.0

References

https://android.googlesource.com/platform/packages/apps/Settings/+/975c28535419be1cc45f66712f41e4a7a40e6001Mailing List, Patch
https://source.android.com/security/bulletin/2024-11-01Patch, Vendor Advisory

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-430897.8In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could le CVE-2024-43098.1SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL q CVE-2024-430905.0In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information dis CVE-2024-430919.8In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code CVE-2024-430937.3In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensit CVE-2024-430957.8In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local es CVE-2024-430968.8In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (pro CVE-2024-430977.8In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation CVE-2024-430985.5In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to CVE-2024-430998.8The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a CVE-2024-43105.4Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially craft CVE-2024-431015.3Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an