CVE-2024-0042 is a High severity (CVSS 7.8) flaw in Android Widevine DRM, where OEM and DRM certificates can be confused because of improperly used cryptography, allowing a local bypass of DRM content protection. Google lists the fix at security patch level 2024-04-05. Devices at that level or later include it, so check and update.
What's affected
- Component: Widevine DRM, listed in the Android Security Bulletin for April 2024. The severity is provided directly by Widevine, per the bulletin.
- Fixed in: security patch level 2024-04-05 or later.
- Android versions: the bulletin's Widevine table has no AOSP version column, and the NVD record lists Android with an unspecified version. I cannot give a version range, so use the patch level.
- Detail: the bulletin reference is marked as not publicly available, and says the update is generally in the latest binary drivers for Pixel devices.
- Record quirk: the NVD description reads "In TBD of TBD", so the function and file were not published. The NVD vector scores it as local, low privilege, and high impact on confidentiality, integrity and availability, which is more than a DRM bypass alone suggests. Treat the bulletin's High rating as the vendor statement.
- Exploitation: the bulletin does not say it is exploited, and the record's KEV flag is false.
How to check if you're exposed
On a device connected with adb:
adb shell getprop ro.build.version.security_patch
A value of 2024-04-05 or later includes the fix. On the device itself, open Settings, About phone, Android version, and read the Android security update date.
For a fleet, pull the patch level from your mobile device management inventory and flag anything older than 2024-04-05.
What to do now
- Collect the security patch level of every Android device you manage.
- Flag devices below 2024-04-05.
- Ask the device maker or carrier for the update that carries the Widevine fix, because the bulletin ties it to vendor binary drivers.
- Set a minimum patch level in your device policy for managed phones and tablets.
- If you ship media apps that rely on Widevine, tell your support team which patch level to ask customers for.
Why it matters
The record maps this to CWE-295 (CWE-295), improper certificate validation. DRM systems rely on certificates to prove which party is a licensed device and which is the content provider. If an OEM certificate can be mistaken for a DRM certificate, the trust boundary blurs and protection can be bypassed locally.
For most organizations this is a content protection issue more than a data breach issue. It matters most if you distribute licensed media, or if your device fleet policy requires every patch level to be current. Either way the action is the same: reach patch level 2024-04-05.
Quick check
What patch level fixes CVE-2024-0042?
Security patch level 2024-04-05 or later, according to the Android Security Bulletin for April 2024.
Why can I not see which Android versions are affected?
The bulletin lists no AOSP versions for Widevine, and the NVD record shows Android with an unspecified version. Use the patch level instead.
Sources
Last reviewed: 19 October 2026.
