CVE-2024-23709
Published: 07 May 2024
Summary
CVE-2024-23709 is a medium-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-23709 is a heap buffer overflow vulnerability (CWE-787) present in multiple locations within the sonivox library used by Android for MIDI processing. The flaw permits an out-of-bounds write that can result in remote information disclosure. It carries a CVSS 3.1 score of 6.5 and affects the external/sonivox component across supported Android builds.
An attacker can trigger the issue by supplying specially crafted input that the victim must interact with, such as a malicious media file. No additional execution privileges are required on the target device, and the attack can be performed over the network provided user interaction occurs.
The May 2024 Android security bulletin lists the issue and points to patches committed to the platform/external/sonivox repository that correct the buffer handling. The EPSS score remains flat at 0.0578 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21170
Vulnerability details
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.