CVE-2024-40673 Overview
CVE-2024-40673 affects the ZipFile.java source in the Android libcore component. The vulnerability stems from improper input validation that allows manipulation of Dynamic Code Loading. An attacker can leverage this flaw to execute arbitrary code without requiring additional execution privileges. Exploitation does not require user interaction, according to the Android Security Bulletin October 2024. The issue is classified under [CWE-94] Improper Control of Generation of Code.
Critical Impact
Successful exploitation enables arbitrary code execution on affected Android devices without user interaction, potentially compromising application integrity and stored data.
Affected Products
- Google Android 12.0
- Google Android 12.1, 13.0
- Google Android 14.0
Discovery Timeline
- 2025-01-28 - CVE-2024-40673 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-40673
Vulnerability Analysis
The vulnerability resides in ZipFile.java, part of the Android libcore library used to handle ZIP archive parsing. The flaw permits an attacker to manipulate Dynamic Code Loading behavior through crafted archive contents. Because Android applications routinely process ZIP-based formats such as APKs, JARs, and downloaded content bundles, the attack surface is broad.
Exploitation results in arbitrary code execution in the context of the affected application. The advisory notes that no additional execution privileges are required and no user interaction is needed. The vulnerability is tracked under [CWE-94] Improper Control of Generation of Code (Code Injection).
Root Cause
The root cause is improper input validation in ZipFile.java when handling archive entries that influence Dynamic Code Loading paths. Insufficient sanitization of controllable inputs allows an attacker to steer the runtime toward loading attacker-supplied code. See the Android Source Code Change for the corrective commit.
Attack Vector
The attack vector is network-based. An attacker delivers a malicious ZIP archive to an application that parses it using the vulnerable ZipFile implementation. When the application invokes Dynamic Code Loading against attacker-influenced content, arbitrary code executes within the application's process. Detailed exploitation code is not publicly documented in the referenced advisories.
Detection Methods for CVE-2024-40673
Indicators of Compromise
- Unexpected DEX, JAR, or native library files written to application-private storage or cache directories after processing untrusted ZIP archives.
- Application processes loading code from non-standard paths, including world-writable or temporary directories.
- Anomalous outbound network connections initiated by applications shortly after ingesting archive content.
Detection Strategies
- Inspect mobile telemetry for dalvik.system.DexClassLoader or PathClassLoader invocations referencing files derived from ZIP archive extraction.
- Monitor for applications on Android 12–14 that have not received the October 2024 security patch level (SPL 2024-10-01 or later).
- Perform static analysis on high-risk apps to identify unsafe use of ZipFile combined with dynamic class loading APIs.
Monitoring Recommendations
- Enforce mobile device management (MDM) policies that report Android security patch levels and flag devices below the 2024-10-01 SPL.
- Correlate mobile app crash and code-load telemetry with recent archive downloads to identify probable exploitation attempts.
- Track vendor OEM patch rollout to ensure downstream Android distributions receive the fix in a timely manner.
How to Mitigate CVE-2024-40673
Immediate Actions Required
- Apply the Android security patch level 2024-10-01 or later on all devices running Android 12.0, 12.1, 13.0, and 14.0.
- Inventory managed Android devices and prioritize patching for those handling untrusted archive content.
- Restrict installation of applications from unverified sources through MDM policy enforcement.
Patch Information
Google addressed the vulnerability in the October 2024 Android Security Bulletin. The fix is committed to the Android libcore project as referenced in the Android Source Code Change. Consult the Android Security Bulletin October 2024 for full patch details and OEM guidance.
Workarounds
- Avoid processing ZIP archives from untrusted sources within applications on unpatched devices.
- Disable or restrict application features that trigger Dynamic Code Loading against user-supplied content until patches are applied.
- Where feasible, isolate high-risk applications on managed profiles to limit blast radius from potential code execution.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output should be 2024-10-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
