CVE-2024-40675 Overview
CVE-2024-40675 is a high-severity denial of service vulnerability in Google Android. The flaw resides in the parseUriInternal method of Intent.java, where improper input validation allows a crafted URI to trigger an infinite loop [CWE-835]. Exploitation requires no user interaction and no elevated privileges. A successful attack causes local denial of service against the Android system process handling intents. Google addressed the issue in the October 2024 Android Security Bulletin. The vulnerability affects Android versions 12, 12L, 13, and 14.
Critical Impact
A malicious application or crafted intent URI can force the Android intent parser into an unbounded loop, exhausting CPU resources and producing a local denial of service on affected devices.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0
- Google Android 14.0
Discovery Timeline
- 2024-10-01 - Google releases security patch in the Android Security Bulletin
- 2025-01-28 - CVE-2024-40675 published to NVD
- 2025-04-22 - Last updated in NVD database
Technical Details for CVE-2024-40675
Vulnerability Analysis
The vulnerability resides in the parseUriInternal function of Intent.java, the core Android framework class that converts URI strings into Intent objects. The parser walks through the URI string and processes structured tokens such as scheme, action, category, component, flags, and extras. Improper validation of one of these tokens lets the parser loop indefinitely without making forward progress through the input.
Because intent URI parsing runs across many Android system services and application processes, a crafted URI delivered through deep links, IPC, notifications, or another application can stall the consuming process. The result is a local denial of service condition affecting availability without compromising confidentiality or integrity.
Root Cause
The root cause is improper input validation in the URI tokenizer inside parseUriInternal. A malformed segment in the intent URI fails to advance the parser index, causing the loop control condition to remain true on every iteration. Google's fix in commit c6b5490ec659b5854fd429f453f75de5befa6359 adjusts the parser to ensure the cursor always progresses or the routine terminates on malformed input. Refer to the Android Source Code Reference for the exact change.
Attack Vector
An attacker delivers a malformed intent URI to a vulnerable parser. Vectors include locally installed applications that pass crafted intents through Intent.parseUri(), web pages that invoke Android intent links, notification payloads, and IPC messages from companion apps. Exploitation does not require user interaction or special permissions, and the affected thread consumes CPU until the process is killed or the device is rebooted.
No public proof of concept code is available. The vulnerability mechanism is described in the Android Security Bulletin 2024-10-01.
Detection Methods for CVE-2024-40675
Indicators of Compromise
- Sustained high CPU usage tied to system_server or an application thread that recently received an intent URI.
- Application Not Responding (ANR) events referencing Intent.parseUri or parseUriInternal in stack traces.
- Unexpected process restarts or lowmemorykiller activity correlated with deep link handling.
Detection Strategies
- Inspect Android logcat and dropbox records for ANR traces containing parseUriInternal frames.
- Review mobile device management (MDM) telemetry for devices running unpatched Android 12, 13, or 14 builds with security patch levels older than 2024-10-01.
- Audit installed applications that programmatically construct or forward intent URIs from untrusted sources such as web content or external messages.
Monitoring Recommendations
- Track Android security patch levels across the fleet and flag devices below the October 2024 patch level.
- Monitor crash and ANR reporting pipelines for repeated failures inside intent parsing code paths.
- Correlate deep link traffic with subsequent process restarts to identify abusive URIs.
How to Mitigate CVE-2024-40675
Immediate Actions Required
- Apply the Android security patch level 2024-10-01 or later to all affected Android 12, 12L, 13, and 14 devices.
- Enforce minimum security patch level policies through MDM and block enrollment of non-compliant devices.
- Review in-house applications that invoke Intent.parseUri() on untrusted input and add defensive validation.
Patch Information
Google published the fix in the Android Security Bulletin 2024-10-01. Device-specific builds incorporating the patch are distributed by original equipment manufacturers (OEMs) and carriers. Verify the device security patch level under Settings to confirm remediation.
Workarounds
- Restrict applications from accepting intent URIs originating from untrusted sources such as arbitrary web pages or external messaging.
- Wrap calls to Intent.parseUri() with length and structural validation, and execute parsing on a bounded worker thread that can be terminated if it stalls.
- Disable or constrain custom URL scheme handlers in applications that do not require them until devices receive the vendor patch.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-10-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
