CVE-2024-31326
Google Android 14.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-31326 is a high-severity Operator Precedence Logic Error (CWE-783) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29222
Vulnerability Data
In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User…
more
interaction is not needed for exploitation.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static analysis directly find incorrect evaluation results caused by precedence mistakes.
Documented development standards and coding rules can require constructs that eliminate ambiguous operator precedence.
Engineering principles can mandate explicit parentheses and precedence rules that structurally prevent the logic error from being written.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, static analysis, testing) directly catch precedence errors while the control also addresses many other development risks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect logic errors caused by precedence issues.
Secure development lifecycle includes code review and testing that can catch precedence errors.
Secure coding standards and guidelines directly address operator precedence mistakes.