Is CVE-2024-43093 being actively exploited?

Yes. CVE-2024-43093 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on November 7, 2024.

What is the CVSS score for CVE-2024-43093?

CVE-2024-43093 has a CVSS 3.1 base score of 7.3 (HIGH).

CVE-2024-43093

HIGH · CVSS 7.3CISA KEV: actively exploitedEPSS 0.7%EU EUVD: exploited

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Key facts

CVSS score: 7.3 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-176
EPSS score: 0.7% (52th percentile)
In CISA KEV: Yes, added November 7, 2024
In EU EUVD: Yes (EUVD-2024-40034)
Published: November 13, 2024
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Android Framework Privilege Escalation Vulnerability

Added to the KEV catalog on November 7, 2024; federal remediation due November 28, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2024-40034 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

google / android
google / android
google / android
google / android
google / android

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Google Pixel Devices on Android 15 - Google LLC - Common Criteria CCEVS-VR-VID-11545-2025 - active
Google Pixel Devices on Android 14 - Google LLC - Common Criteria CCEVS-VR-VID-11419-2024 - archived
Google Pixel Devices on Android 13 - Google LLC - Common Criteria CCEVS-VR-11317-2023 - archived
Google Pixel Phones on Android 12.0 - Google LLC - Common Criteria CCEVS-VR-11239-2022 - archived

References

https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10(Patch)
https://source.android.com/security/bulletin/2025-03-01(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093(Third Party Advisory, US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain