{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2024-43093",
  "revision": 1,
  "title": "Android Framework — unicode handling opens protected directories",
  "summary": "A file path filter in Android's external storage provider normalises unicode incorrectly, so an app reaches directories the filter was meant to keep it out of, raising its privileges without any prompt.",
  "source_type": "cve",
  "severity": "high",
  "cvss": {
    "score": 7.3,
    "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.00715,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2024-11-07",
    "prerequisites": "An app already installed on the device; no user interaction needed."
  },
  "remediation": {
    "patch_available": true
  },
  "kill_chain": "privilege_escalation",
  "recommended_action": "Install the March 2025 Android security patch level or later; on devices past vendor support, plan replacement instead of waiting.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "references",
        "published_at"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2024-43093",
      "retrieved_at": "2026-09-24T12:03:01.274Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-09-24T12:03:01.274Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2024-43093",
      "retrieved_at": "2026-09-24T12:03:01.274Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2024-43093",
      "retrieved_at": "2026-09-24T12:03:01.274Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43093",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10"
    },
    {
      "type": "vendor_advisory",
      "url": "https://source.android.com/security/bulletin/2025-03-01"
    },
    {
      "type": "writeup",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093"
    }
  ],
  "published_at": "2024-11-13T18:15:21.713Z",
  "issued_at": "2026-09-24T12:03:01.274Z",
  "tags": [
    "android",
    "framework",
    "path-filter",
    "privilege-escalation",
    "kev"
  ]
}