CVE-2024-43082

In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

• CWE-125

• https://android.googlesource.com/platform/frameworks/base/+/6aa1b4fbf5936a1ff5bdbb79397c94910a6ed8f5Mailing List, Patch
• https://source.android.com/security/bulletin/2024-11-01Patch, Vendor Advisory

Published

Nov 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43067Memory corruption occurs during the copying of read data fro…7.8
• CVE-2024-4307SQL injection vulnerability in HubBank affecting version 1.0…8.1
• CVE-2024-43077In DevmemValidateFlags of devicemem_server.c , there is a po…7.8
• CVE-2024-4308SQL injection vulnerability in HubBank affecting version 1.0…8.1
• CVE-2024-43080In onReceive of AppRestrictionsFragment.java, there is a pos…7.8
• CVE-2024-43081In installExistingPackageAsUser of InstallPackageHelper.java…7.8
• CVE-2024-43083In validate of WifiConfigurationUtil.java , there is a possi…5.5
• CVE-2024-43084In visitUris of multiple files, there is a possible informat…5.5
• CVE-2024-43085In handleMessage of UsbDeviceManager.java, there is a possib…7.8
• CVE-2024-43086In validateAccountsInternal of AccountManagerService.java, t…5.5
• CVE-2024-43087In getInstalledAccessibilityPreferences of AccessibilitySett…7.8
• CVE-2024-43088In multiple functions in AppInfoBase.java, there is a possib…7.8