CVE-2023-40107 is a High severity (CVSS 7.8) Android flaw in ARTPWriter.cpp in the media framework, described as a use after free in ARTPWriter that could lead to local escalation of privilege. Google's November 2023 bulletin fixes it at security patch level 2023-11-01 or later, so update affected devices to that patch level.
What's affected
Affected: Android versions 12, 12L, 13 and 14, per Google's Android Security Bulletin for November 2023, where this CVE is listed under Framework with a High severity. Fixed: devices at security patch level 2023-11-01 or later.
The NVD record lists the same Android releases as affected, with a CVSS 3.1 score of 7.8. Both sources agree on High severity and I found no conflict. Patch availability still depends on your device maker or carrier, because the bulletin describes the platform fix and not each vendor's rollout date.
How to check if you're exposed
On a device, open Settings, then About phone, then Android version, and read the Android security update date. It should read 2023-11-01 or later. For managed fleets you can read the same value over adb:
adb shell getprop ro.build.version.security_patch
A date earlier than 2023-11-01 means the fix is missing. Your mobile device management console will usually show this as a column so you can report across the whole estate.
What to do now
- Pull the security patch level for every managed Android device and flag anything older than 2023-11-01.
- Push or request the update from the device manufacturer or carrier, and set a deadline in your device policy.
- Block or quarantine devices that cannot receive updates from sensitive corporate resources.
- Retire devices that have reached end of support from their maker.
- Add a patch level check to your device compliance policy so this question answers itself next time.
Why it matters
The weakness class is CWE-416 (use after free). The record describes a use after free in ARTPWriter in ARTPWriter.cpp in the media framework, which could lead to local escalation of privilege with no additional execution privileges and no user interaction needed. The score is 7.8, with a local attack vector and low privileges required.
Local privilege escalation bugs matter because they turn a small foothold, such as a malicious app already installed, into broader control of the device. They are one link in a chain, and monthly platform patches exist to cut those chains. NVD published the record on 2024-02-15. The KEV flag is false and the bulletin does not say it is exploited.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
What patch level fixes this?
Google's bulletin says devices at security patch level 2023-11-01 or later address these issues.
Is it being exploited?
The KEV flag is false and the bulletin entry does not claim exploitation.
Sources
Last reviewed: 19 October 2026.
