← Vulnerability feed

Vulnerability record · CVE-2024-43093 · published 13 November 2024

CVE-2024-43093: Android ExternalStorageProvider path filter bypass via unicode normalization

Google · Android

ExternalStorageProvider.java's shouldHideDocument function fails to correctly normalize unicode, allowing a crafted file path to bypass the filter that blocks access to sensitive directories. This is a local privilege escalation flaw in the Android framework, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so real-world exploitation is confirmed.

7.3 CVSS 3.1 High CISA KEV since 7 Nov 2024 EPSS 0.72% · top 48.2% CWE-176 · CWE-176
7.3CVSS 3.1 base score
0.72%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a confirmed exploited local privilege escalation in Android with high confidentiality, integrity and availability impact, though exploitation requires local access and user interaction.

What it is

ExternalStorageProvider.java's shouldHideDocument function fails to correctly normalize unicode, allowing a crafted file path to bypass the filter that blocks access to sensitive directories. This is a local privilege escalation flaw in the Android framework, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so real-world exploitation is confirmed.

Impact

An attacker who can get a user to interact with a crafted file or path gains access to protected directories and can escalate privileges on the device, with high impact to confidentiality, integrity and availability.

Attack surface

The attack is local (AV:L) and requires low privileges (PR:L) plus user interaction (UI:R), meaning a malicious app or local actor must induce the user to open or handle a crafted path. No network vector or additional execution privileges are needed.

Exploitation

CVE-2024-43093 is in CISA KEV (added 2024-11-07, due 2024-11-28), confirming active exploitation, while EPSS is low at roughly 0.7% for 30 days. No ransomware campaign use is documented.

What to do

  • Apply the Android security patch referenced in the AOSP commit and the March 2025 Android security bulletin as soon as it is available for the device.
  • If patching is not possible, follow CISA's required action and discontinue use of affected devices or isolate them from sensitive data.
  • Restrict installation of untrusted apps and review app storage permissions to reduce the local attack surface.
  • Educate users not to open unexpected files or paths from untrusted sources, since exploitation requires user interaction.

Detection

  • Monitor for anomalous file access attempts against protected Android directories from third-party apps.
  • Audit app behavior around ExternalStorageProvider and document access for paths containing unusual unicode sequences.
  • Track patch status of Android devices against the March 2025 bulletin and flag unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2024-43093 to the Known Exploited Vulnerabilities catalog on 7 November 2024 as "Android Framework Privilege Escalation Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 28 November 2024.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10 Patch
https://source.android.com/security/bulletin/2025-03-01 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093 Third Party AdvisoryUS Government Resource

Track CVE-2024-43093 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed8.8CVE-2025-48543Android use-after-free allows Chrome sandbox escape to system_serverA use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the fl…KEVEPSS 0.54%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed7.8CVE-2023-20963Android WorkSource parcel mismatch local privilege escalationCVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional executio…KEVEPSS 1.5%analysed

Source: NIST National Vulnerability Database (record CVE-2024-43093), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.