CVE-2024-32896

high

Description

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

Exploits
More

https://thehackernews.com/2025/04/google-reports-75-zero-days-exploited.html

https://thehackernews.com/2024/11/google-warns-of-actively-exploited-cve.html

https://securityaffairs.com/170581/uncategorized/cve-2024-43093-android-flaw-actively-exploited.html

https://www.bleepingcomputer.com/news/security/google-backports-fix-for-pixel-eop-flaw-to-other-android-devices/

https://thehackernews.com/2024/09/google-confirms-cve-2024-32896.html

https://securityaffairs.com/168047/mobile-2/google-fixed-actively-exploited-android-flaw-cve-2024-32896.html

https://thehackernews.com/2024/08/google-patches-new-android-kernel.html

https://www.bleepingcomputer.com/news/security/google-fixes-android-kernel-zero-day-exploited-in-targeted-attacks/

https://www.securityweek.com/google-warns-of-pixel-firmware-zero-day-under-limited-targeted-exploitation/

https://source.android.com/security/bulletin/pixel/2024-06-01

Details

Source: Mitre, NVD

Published: 2024-06-13

Updated: 2024-11-29

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H