CVE-2024-43093

HighCVSS 7.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-176

Affected software

Vendor	Product	Versions
Google	Android	15; 14; 13; 12L; 12

References

https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10Patch
https://source.android.com/security/bulletin/2025-03-01Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093Third Party Advisory, US Government Resource

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 7, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-430957.8In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local es CVE-2024-430968.8In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (pro CVE-2024-430977.8In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation CVE-2024-430985.5In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to CVE-2024-430998.8The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a CVE-2024-43105.4Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially craft CVE-2024-431015.3Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an CVE-2024-4310210.0Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreas CVE-2024-431054.3Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume exc CVE-2024-431069.1A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privile CVE-2024-431077.2Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm e CVE-2024-431086.5The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms