Back

CVE-2024-40656

Sept. 11, 2024, 4:26 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Android

Source

security@android.com

Tags

security@android.com
2024-09-11
CVE-2024-40656

CVE-2024-40656 details

Published : Sept. 11, 2024, 12:15 a.m.
Last Modified : Sept. 11, 2024, 4:26 p.m.

Description

In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVSS Score

1 2 3 4 5 6 7 8 9 10

Weakness

Weakness Name Description

References

URL Source
https://android.googlesource.com/platform/packages/services/Telecomm/+/f3e6a6c02439401eb7aeb3749ee5ec0b51a625b9 security@android.com
https://source.android.com/security/bulletin/2024-09-01 security@android.com
This website uses the NVD API, but is not approved or certified by it.