CVE-2023-40114 is a high severity (CVSS 7.8) use-after-free in several functions of MtpFfsHandle.cpp in Android. The freed memory is later written to, which can lead to local escalation of privilege. Install security patch level 2023-11-01 or later.
What's affected
The record lists Google Android and scores CVE-2023-40114 at 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-416 (use after free) that leads to an out-of-bounds write.
Our sources disagree on versions here. The NVD record lists Android 11.0, 12.0 and 12.1 as affected. The bulletin's table lists AOSP versions 11, 12, 12L, 13 and 14. Because the bulletin is the vendor source, plan on every supported Android release up to 14 until your device maker says otherwise.
The fix is in the Android security patch level 2023-11-01 or later. The Android Security Bulletin lists the issue under the Framework component with a type of elevation of privilege and a High severity.
How to check if you're exposed
On a device you manage, the quickest test is the security patch level. Open Settings, then About phone, then Android version, and read the Android security update date. It should be 2023-11-01 or later.
If you manage a fleet or test devices over a cable, the same value is available from the shell:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A patch string earlier than the one above means the November 2023 fixes are not present. Many Android vendors ship their own schedule, so also check the manufacturer's bulletin for the model rather than assuming the platform date applies. For app and image inventories, an open source dependency scan will not see operating system flaws like this one, so track it through your mobile device management compliance reports.
What to do now
- List the Android devices in scope, including test phones, kiosks and tablets, and record their security patch level.
- Update anything below 2023-11-01 to the latest build from the device maker or carrier.
- For devices that can no longer receive updates, retire them from access to company data or move them to a restricted network segment.
- Set a compliance rule in your mobile device management tool that flags devices more than one or two patch levels behind.
- Tell users to install apps only from trusted stores while updates roll out, since the flaw is reached through a local app or file.
Why it matters
The description says the out-of-bounds write is caused by a use after free. In plain terms, the code keeps a pointer to a buffer after the buffer has been released, then writes through it. If something else has taken over that memory, the write can corrupt it.
MtpFfsHandle.cpp belongs to the same media transfer protocol area as CVE-2023-40110, but it is a separate bug with its own fix. The class of weakness is CWE-416. The record rates it 7.8 with user interaction required.
Treat the pair together when you plan patching. Both land in the same bulletin, so one update covers both.
Quick check
Is this the same bug as CVE-2023-40110?
No. Both touch the media transfer protocol code, but this one is a use after free in MtpFfsHandle.cpp and the other is a heap overflow in MtpPacket.cpp. They have separate source changes and separate CVE ids, and the same patch level covers both.
Is CVE-2023-40114 remotely exploitable?
The record's vector is local (AV:L). The weakness sits in code on the device, and the description says it leads to local escalation of privilege. It does not describe a network attack path.
Sources
Last reviewed: 19 October 2026.
