CVE-2024-32896
Google Android
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2024-32896 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 14% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-32896 is a logic error that permits a bypass in affected code, enabling local privilege escalation on Android devices. The flaw is tracked under CWEs 670 and 783 and carries a CVSS 3.1 score of 7.8 reflecting local attack vector, low complexity, no privileges required, and required user interaction. It is addressed in the June 2024 Pixel security bulletin and impacts Pixel devices running vulnerable builds of Android.
An attacker with the ability to supply malicious input on the same device can exploit the flaw to elevate privileges and obtain full control over confidentiality, integrity, and availability of the system. No additional execution privileges are needed beyond the initial local access, though user interaction is required to trigger the bypass.
The referenced Android security bulletin and CISA Known Exploited Vulnerabilities catalog indicate that patches have been issued and that the vulnerability has seen active exploitation in the wild. The current EPSS score of 0.0019 remains low.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-30666
Vulnerability Data
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- CWE(s)
- KEV Date Added
- 13 June 2024
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V9.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises control-flow paths and reveals mismatches between implemented and intended behavior.
Requiring a documented development process and supporting tools reduces the chance that incorrect control-flow logic is introduced in the first place.
Engineering principles can mandate explicit parentheses and precedence rules that structurally prevent the logic error from being written.
Flaw identification and remediation processes can locate and correct control-flow errors once they manifest as incorrect runtime behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent incorrect control-flow implementations via reviews, testing, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect paths that deviate from intended logic.
Secure development lifecycle processes can catch incorrect control-flow logic during design and code review.
Secure coding standards and reviews directly target flawed control-flow implementations.
Change-management gates may prevent deployment of flawed logic but do not address the coding defect itself.