CVE-2023-21031

In Display::setPowerMode of HWC2.cpp, there is a possible out of bounds read due to a race...

4.7 MediumFix available

In setPowerMode of HWC2.cpp, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-242688355

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.08%Unchanged since Mar 25, 2023

What each source reports

NVD Score used 4.7

Record: CVE-2023-21031
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125, CWE-362
Updated: 2026-11-02

CVE List 4.7

Record: CVE-2023-21031
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-362
Updated: 2026-11-02

EUVDEUVD-2023-25199 4.7

Record: EUVD-2023-25199
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6ccc-rrj9-234c 4.7

In Display::setPowerMode of HWC2.cpp, there is a possible out of bounds read due to a race...

In Display::setPowerMode of HWC2.cpp, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-242688355

Record: GHSA-6ccc-rrj9-234c
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125, CWE-362
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-21031 4.7

Record: UBUNTU-CVE-2023-21031
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVPUB-A-242688355 No score

Record: PUB-A-242688355
Updated: 2026-11-05

Affected products

google android

Affected packages

Affected packages
Package	Affected	Fixed
`platform/frameworks/native` Android	13-next:0 up to 13-next:2023-06-01, plus listed versions 13-next	13-next:2023-06-01
`platform/frameworks/native` Android	13:0 up to 13:2023-06-01, plus listed versions 13	13:2023-06-01
`android-platform-frameworks-native` Ubuntu:16.04:LTS	All versions, plus listed versions 21-31:6.0.0+r26-21:6.0.1+r16-1	None known
`android-platform-frameworks-native` Ubuntu:18.04:LTS	All versions, plus listed versions 1:7.0.0+r33-11:8.1.0+r23-2~18.04	None known
`android-platform-frameworks-native` Ubuntu:20.04:LTS	All versions, plus listed versions 1:8.1.0+r23-21:8.1.0+r23-2build1	None known
`android-platform-frameworks-native` Ubuntu:22.04:LTS	All versions, plus listed versions 1:10.0.0+r36-1	None known
`android-platform-tools` Ubuntu:22.04:LTS	All versions, plus listed versions 29.0.6-329.0.6-429.0.6-4ubuntu1	None known
`android-platform-frameworks-native` Ubuntu:24.04:LTS	All versions, plus listed versions 1:10.0.0+r36-1	None known
`android-platform-tools` Ubuntu:24.04:LTS	All versions, plus listed versions 33.0.3-234.0.4-1build234.0.4-1build3	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-21031 is a medium vulnerability (CVSS 4.7) in Google Android, published March 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.08%, the 0th percentile. Fixed in platform/frameworks/native 13-next:2023-06-01.