CVE-2023-40110 is a high severity (CVSS 7.8) out-of-bounds write in several functions of MtpPacket.cpp in Android. A heap buffer overflow there can lead to local escalation of privilege. The fix ships with Android security patch level 2023-11-01 or later.
What's affected
The record lists Google Android and scores CVE-2023-40110 at 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-787 (out-of-bounds write), described as a heap buffer overflow.
Our sources disagree on versions here. The NVD record lists Android 11.0, 12.0 and 12.1 as affected. The bulletin's table lists AOSP versions 11, 12, 12L, 13 and 14. Because the bulletin is the vendor source, plan on every supported Android release up to 14 until your device maker says otherwise.
The fix is in the Android security patch level 2023-11-01 or later. The Android Security Bulletin lists the issue under the Framework component with a type of elevation of privilege and a High severity.
How to check if you're exposed
On a device you manage, the quickest test is the security patch level. Open Settings, then About phone, then Android version, and read the Android security update date. It should be 2023-11-01 or later.
If you manage a fleet or test devices over a cable, the same value is available from the shell:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A patch string earlier than the one above means the November 2023 fixes are not present. Many Android vendors ship their own schedule, so also check the manufacturer's bulletin for the model rather than assuming the platform date applies. For app and image inventories, an open source dependency scan will not see operating system flaws like this one, so track it through your mobile device management compliance reports.
What to do now
- List the Android devices in scope, including test phones, kiosks and tablets, and record their security patch level.
- Update anything below 2023-11-01 to the latest build from the device maker or carrier.
- For devices that can no longer receive updates, retire them from access to company data or move them to a restricted network segment.
- Set a compliance rule in your mobile device management tool that flags devices more than one or two patch levels behind.
- Tell users to install apps only from trusted stores while updates roll out, since the flaw is reached through a local app or file.
Why it matters
MtpPacket.cpp is part of the media transfer protocol code, the piece that lets a phone present itself to a computer as a device for moving files over USB. It parses packets, and an out-of-bounds write happens when a length or count is trusted more than it should be.
A heap overflow is a memory safety bug, the same family as many of the high severity entries in the mobile bulletins. The record scores it 7.8 and says user interaction is needed, with local access and no privileges. The weakness is CWE-787.
Memory corruption fixes tend to be small in the source tree, which is why the bulletin links a single change. The cost is in rollout, because each device maker has to ship the update.
Quick check
Is CVE-2023-40110 remotely exploitable?
The record's vector is local (AV:L). The weakness sits in code on the device, and the description says it leads to local escalation of privilege. It does not describe a network attack path.
Does the record say this is exploited in the wild?
No. The record's KEV flag is false, and the November 2023 bulletin entry we read does not say it is exploited. Treat it as a patch to apply on schedule, not an emergency.
Sources
Last reviewed: 19 October 2026.
