CVE-2024-40673

MEDIUM

Android Java ZipFile - Dynamic Code Loading Remote Code Execution

Title source: manual

Description

In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

References (2)

Core 2

Core References

Product

https://android.googlesource.com/platform/libcore/+/b17fd2f8fe468e7d32e713b442f610cd33e4e7a9

Vendor Advisory

https://source.android.com/security/bulletin/2024-10-01

Scores

CVSS v3 6.5

EPSS 0.0166

EPSS Percentile 82.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-94

Status published

Products (4)

google/android 12.0

google/android 12.1

google/android 13.0

google/android 14.0

Published Jan 28, 2025

Tracked Since Feb 18, 2026