CVE-2024-29745: medium-severity vulnerability in Google Android
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A part of the system doesn't properly clean up data in memory before using it, which can leak private information to unauthorized users on the same device. No special access or user action is needed for this to happen.
Uninitialized memory buffer is accessed before being set to safe values, allowing local attackers to read sensitive data without elevated privileges or user interaction. This is a classic information disclosure vulnerability where residual data from previous operations remains accessible.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.