CVE-2023-40115 is a high severity (CVSS 7.8) use-after-free in readLogs of StatsService.cpp in Android's Statsd module. It can corrupt memory and lead to local escalation of privilege, and the description says no user interaction is needed. Update to the November 2023 patch level.
What's affected
The record lists Google Android and scores CVE-2023-40115 at 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-416 (use after free), described as memory corruption.
Our sources disagree on versions here. The NVD record lists Android 11.0, 12.0 and 12.1 as affected. The bulletin's table lists AOSP versions 11, 12, 12L, 13 and 14. Because the bulletin is the vendor source, plan on every supported Android release up to 14 until your device maker says otherwise. This one is also delivered as a Google Play system update, because Statsd is a Project Mainline component, so a device can receive the fix without a full operating system release.
The fix is in the Android security patch level 2023-11-01 or later. The Android Security Bulletin lists the issue under the System component with a type of elevation of privilege and a High severity.
How to check if you're exposed
On a device you manage, the quickest test is the security patch level. Open Settings, then About phone, then Android version, and read the Android security update date. It should be 2023-11-01 or later.
If you manage a fleet or test devices over a cable, the same value is available from the shell:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A patch string earlier than the one above means the November 2023 fixes are not present. Many Android vendors ship their own schedule, so also check the manufacturer's bulletin for the model rather than assuming the platform date applies. For app and image inventories, an open source dependency scan will not see operating system flaws like this one, so track it through your mobile device management compliance reports.
What to do now
- List the Android devices in scope, including test phones, kiosks and tablets, and record their security patch level.
- Update anything below 2023-11-01 to the latest build from the device maker or carrier.
- For devices that can no longer receive updates, retire them from access to company data or move them to a restricted network segment.
- Set a compliance rule in your mobile device management tool that flags devices more than one or two patch levels behind.
- Tell users to install apps only from trusted stores while updates roll out, since the flaw is reached through a local app or file.
Why it matters
This is the one entry in the group where the record's vector differs. It needs low privileges but no user interaction (PR:L, UI:N), so a local app that is already on the device does not need to trick anyone. That makes it more interesting than the other four for shared or managed devices.
The code in question reads logs inside the statistics service. A use after free here means a buffer was released and then read or written again. The class is CWE-416.
The Mainline delivery path is worth noting for fleet owners. Check the Google Play system update version in Settings as well as the monthly patch level, because the two can move on different dates.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can this fix arrive without a full Android update?
Yes. The bulletin lists the Statsd fix under Google Play system updates (Project Mainline) as well as the patch level, so devices that receive Mainline modules can get it through that channel.
Is CVE-2023-40115 remotely exploitable?
The record's vector is local (AV:L). The weakness sits in code on the device, and the description says it leads to local escalation of privilege. It does not describe a network attack path.
Sources
Last reviewed: 19 October 2026.
