CVE-2024-0024 is a High severity (CVSS 7.8) elevation of privilege flaw in the Framework component of Android, in several methods in UserManagerService.java. Google fixed it in the May 2024 Android Security Bulletin. Devices with security patch level 2024-05-01 or later include the fix, so check each device's patch level and update.
What's affected
- Platform: Android (AOSP versions 12, 12L, 13 and 14 per the bulletin). Component: the Framework component.
- Fixed in: security patch level 2024-05-01 or later.
- Severity: High, CVSS 7.8, in the NVD record. The bulletin also rates it High.
- Exploitation: the record's KEV flag is false, and the bulletin does not say it is exploited in the wild or in targeted attacks.
- Detail: The record says multiple methods of UserManagerService.java can fail to persist or enforce user restrictions because of improper input validation. The outcome is local elevation of privilege, and user interaction is needed.
The two sources differ. The NVD record lists Android 12, 12L, 13, while the bulletin lists 12, 12L, 13 and 14. The bulletin is the vendor source, so treat every version it lists as affected and use the patch level as your test.
Android fixes reach people through device makers and carriers, so the date a patch exists and the date it lands on a device can be months apart. Patch level, not version number, tells you which one you have.
How to check if you're exposed
On a device connected with adb, read the patch level:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A first value of 2024-05-01 or later includes the fix. The date format sorts correctly as text, so a simple string comparison works in a script. On the device, open Settings, About phone, Android version, and read the Android security update date.
For managed fleets, export patch levels from your mobile device management console and flag every device below 2024-05-01. Pay attention to devices that no longer receive updates, since they cannot reach the fixed level at all.
What to do now
- Collect the security patch level of every Android phone, tablet and embedded device you manage.
- Flag devices below 2024-05-01.
- Install the vendor update that carries the May 2024 fixes. If the device maker has not shipped one, ask for a date.
- Set a minimum patch level in your device policy, and block or limit access for devices that fall behind.
- For devices that will never get the update, retire them or keep them away from sensitive data.
Why it matters
The record maps this to CWE-269 (improper privilege management). Privileges are assigned or kept in a way that gives code more power than it should have.
Local means the attacker, or a malicious app, must already run code on the device. This flaw raises what that code can do, so it matters most on devices that install apps from several sources or hold work data. The record does not flag it in CISA's Known Exploited Vulnerabilities catalog, and the bulletin does not report exploitation. That is not proof that it is safe, only that no source I read says it is being used.
An operating system flaw like this never appears in your app's dependency tree, so a package scan will not catch it. It shows up as a device inventory problem. A free in-browser dependency scan covers the libraries your own mobile app ships, which is the part of the Android stack you do control.
Quick check
Which patch level fixes CVE-2024-0024?
Security patch level 2024-05-01 or later, according to the Android Security Bulletin for May 2024.
Is CVE-2024-0024 exploited in the wild?
The record's KEV flag is false and the bulletin does not report exploitation. Check the CISA catalog for changes.
Sources
Last reviewed: 19 October 2026.
