High severity7.8NVD Advisory· Published Aug 15, 2024· Updated Jun 17, 2026

CVE-2024-34740

Description

In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Androidv55 versions
14+ 4 more
- (no CPE)range: 14
- cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
Android X86/android-x86llm-fuzzy

Patches

Vulnerability mechanics

References

android.googlesource.com/platform/frameworks/base/+/e8b6505647be558ed3a167a1e13c53dfc227d22bnvdMailing ListPatch
android.googlesource.com/platform/frameworks/libs/modules-utils/+/700c28908051ceb55e1456d2d21229bc17c6895anvdMailing ListPatch
source.android.com/security/bulletin/2024-08-01nvdPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000