CVE-2024-47040

A logical error in the code leads to a situation where a memory area is freed but remains accessible for use (use-after-free, CWE-416). An attacker can exploit this state to manipulate code execution flow in a way that leads to obtaining higher system privileges. Exploitation does not require any additional execution permissions or user interaction.

An attacker with local access to the device can obtain privilege escalation to a higher system level without the need for additional permissions. Successful exploitation of the vulnerability can lead to complete takeover of system control.

Security patches from the manufacturer must be applied according to references — Android/Pixel security bulletin dated 2024-11-01 available at https://source.android.com/security/bulletin/pixel/2024-11-01

Google Android — specific versions indicated in the manufacturer's references (Pixel security bulletin from November 2024)