CVE-2024-0031 is a Critical severity (CVSS 9.8) remote code execution flaw in the System component of Android, in attp_build_read_by_type_value_cmd in att_protocol.cc. Google fixed it in the February 2024 Android Security Bulletin. Devices with security patch level 2024-02-01 or later include the fix, so check each device's patch level and update.
What's affected
- Platform: Android (AOSP versions 11, 12, 12L, 13 and 14 per the bulletin). Component: the System component (Bluetooth module).
- Fixed in: security patch level 2024-02-01 or later.
- Severity: Critical, CVSS 9.8, in the NVD record. The bulletin also rates it Critical.
- Exploitation: the record's KEV flag is false, and the bulletin does not say it is exploited in the wild or in targeted attacks.
- Detail: The record describes an out of bounds write caused by improper input validation in attp_build_read_by_type_value_cmd of att_protocol.cc. It could lead to remote code execution with no extra privileges and no user interaction.
The two sources differ. The NVD record lists Android 11, 12, 12L, while the bulletin lists 11, 12, 12L, 13 and 14. The bulletin is the vendor source, so treat every version it lists as affected and use the patch level as your test.
Android fixes reach people through device makers and carriers, so the date a patch exists and the date it lands on a device can be months apart. Patch level, not version number, tells you which one you have.
How to check if you're exposed
On a device connected with adb, read the patch level:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A first value of 2024-02-01 or later includes the fix. The date format sorts correctly as text, so a simple string comparison works in a script. On the device, open Settings, About phone, Android version, and read the Android security update date.
For managed fleets, export patch levels from your mobile device management console and flag every device below 2024-02-01. Pay attention to devices that no longer receive updates, since they cannot reach the fixed level at all.
What to do now
- Collect the security patch level of every Android phone, tablet and embedded device you manage.
- Flag devices below 2024-02-01.
- Install the vendor update that carries the February 2024 fixes. If the device maker has not shipped one, ask for a date.
- Set a minimum patch level in your device policy, and block or limit access for devices that fall behind.
- For devices that will never get the update, retire them or keep them away from sensitive data.
Why it matters
The record maps this to CWE-20 (improper input validation), CWE-787 (out of bounds write). The code accepts input without checking that it is valid, and later steps trust it. The code writes data past the end of a memory buffer, which can corrupt nearby memory and sometimes let an attacker steer what the code does next.
The record vector is network based, with no privileges and no user interaction, which is why the score is 9.8. Bluetooth is a short range radio, so exposure depends on whether Bluetooth is on and who is nearby. The record does not flag it in CISA's Known Exploited Vulnerabilities catalog, and the bulletin does not report exploitation. That is not proof that it is safe, only that no source I read says it is being used.
An operating system flaw like this never appears in your app's dependency tree, so a package scan will not catch it. It shows up as a device inventory problem. A free in-browser dependency scan covers the libraries your own mobile app ships, which is the part of the Android stack you do control.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which patch level fixes CVE-2024-0031?
Security patch level 2024-02-01 or later, according to the Android Security Bulletin for February 2024.
Is CVE-2024-0031 exploited in the wild?
The record's KEV flag is false and the bulletin does not report exploitation. Check the CISA catalog for changes.
Sources
Last reviewed: 19 October 2026.
