CVE-2024-43093
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path...
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Record
CVE-2024-43093- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-176
- Updated
- 2026-11-02
CVE List
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Record
CVE-2024-43093- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-176
- Updated
- 2026-11-02
EUVDEUVD-2024-40034
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Record
EUVD-2024-40034- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9g9p-59w9-vqqc
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path...
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Record
GHSA-9g9p-59w9-vqqc- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-176
- Updated
- 2026-11-02
CISA KEV No score
Android Framework Privilege Escalation Vulnerability
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
- Record
CVE-2024-43093- Updated
- 2026-11-02
OSVASB-A-341680936 No score
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Record
ASB-A-341680936- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
platform/frameworks/baseAndroid |
15-next:0 up to 15-next:2025-03-01, plus listed versions 15-next |
15-next:2025-03-01 |
platform/frameworks/baseAndroid |
12:0 up to 12:2025-03-01, plus listed versions 12 |
12:2025-03-01 |
platform/frameworks/baseAndroid |
12L:0 up to 12L:2025-03-01, plus listed versions 12L |
12L:2025-03-01 |
platform/frameworks/baseAndroid |
15:0 up to 15:2025-03-01, plus listed versions 15 |
15:2025-03-01 |
platform/frameworks/baseAndroid |
13:0 up to 13:2025-03-01, plus listed versions 13 |
13:2025-03-01 |
platform/frameworks/baseAndroid |
14:0 up to 14:2025-03-01, plus listed versions 14 |
14:2025-03-01 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | xiaoxiaoyu78/gki-unicode-fix | 2026-10-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-43093 is a high vulnerability (CVSS 7.3) in Android Framework, published November 13, 2024. CISA lists it as known to be exploited, since November 7, 2024. EUVD reports exploitation since November 7, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in platform/frameworks/base 15-next:2025-03-01.
References
android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10
source.android.com/security/bulletin/2025-03-01
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093
nvd.nist.gov/vuln/detail/CVE-2024-43093
github.com/advisories/GHSA-9g9p-59w9-vqqc