CVE-2024-23706

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-07 · updated 2026-06-17
Weakness: CWE-20

Description

In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Android: 14.0

References

https://android.googlesource.com/platform/packages/modules/HealthFitness/+/6e6896c3fd8139779ff8d51a99ee06667e849d87
https://source.android.com/security/bulletin/2024-05-01
https://android.googlesource.com/platform/packages/modules/HealthFitness/+/6e6896c3fd8139779ff8d51a99ee06667e849d87
https://source.android.com/security/bulletin/2024-05-01

Get alerted when CVE-2024-23706 or the next vulnerability affects your stack