CVE-2024-7448 is a high severity command injection, scored 8.0, in Magnet Forensics AXIOM. It sits in the Android device image acquisition feature and can lead to code execution. Magnet says it issued an update, but the advisory names no version, so check the release notes.
What's affected
The record lists AXIOM 8.0.0.39753. The Zero Day Initiative advisory ZDI-24-1129 says only that the flaw is in AXIOM's Android device image acquisition functionality, and does not give a full list of affected builds.
Fixed version: not confirmed. ZDI quotes the vendor as saying "Magnet Forensics has issued an update to correct this vulnerability" and points to the AXIOM release notes. The release notes page I checked in October 2026 showed only one release, 10.4.0.50120, and did not mention this issue. Earlier notes were not on that page. Ask Magnet Forensics support, or read the release notes for builds after 8.0, to find the exact fixed build.
The weakness is CWE-78, OS command injection. The sources agree on severity: CVSS 8.0 with the vector AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The adjacent network vector is why it scores below 9.
How to check if you're exposed
- Open AXIOM on each examiner workstation and read the version from the Help or About screen.
- Compare it with the vendor's release notes. If you are on 8.0.0.39753 or any build you cannot place after the fix, treat it as exposed.
- List who runs Android acquisitions. Only that workflow is described as affected.
- Check whether examiners acquire from devices that are not controlled, such as seized or third-party phones. That is the situation the advisory describes.
What to do now
- Update AXIOM to the current release from Magnet Forensics.
- Confirm in the release notes, or with the vendor, that the build includes the fix for ZDI-24-1129.
- Until updated, avoid Android acquisitions from devices you cannot vet, or run them on an isolated machine.
- Keep examiner workstations on a separate network segment from general office systems.
- Keep a record of the AXIOM version used for each case, so you can answer questions later.
Why it matters
Per ZDI, the flaw comes from a lack of proper validation of a user-supplied string before it is used in a system call. That is the textbook form of command injection: data that should be inert is passed to the operating system as part of a command.
The unusual part is where the data comes from. In most advisories the hostile input arrives from a website or a request. Here it comes from the device being examined. A forensic tool exists to read data from devices it does not trust, so its parsers deserve the same care as an internet-facing service.
Exploitation needs user interaction, in that the target must acquire data from a malicious mobile device. The attacker also must be network-adjacent. Code runs as the current user, which on an examiner workstation can reach case data. The record's KEV flag is false, and the sources do not report exploitation in the wild. ZDI shows the report went to the vendor on 5 June 2024 and went public on 13 August 2024.
Quick check
Which AXIOM version fixes CVE-2024-7448?
The advisory does not say. Magnet Forensics states it issued an update, so check the vendor release notes or ask support for the exact build.
Does an attacker need to be on my network?
The vector is network-adjacent, and the target must acquire data from a malicious mobile device. Both conditions matter for the 8.0 score.
Sources
Last reviewed: 19 October 2026.
