October 2023: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 26 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r1 adds the fix for 6 CVEs: CVE-2023-21252, CVE-2023-40121, CVE-2023-40125, CVE-2023-40127, CVE-2023-40131, CVE-2023-40140.

Announced, with no public code

None this month.

Public before it was announced

None this month.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 4 fixes in android-security-14.0.0_r1

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-21252 · platform/packages/modules/Wifi
  Adds an isWapi flag to WifiConfigurationUtil.validatePassword. A WAPI-PSK hex preSharedKey is then capped at 100 characters instead of going through the generic PSK_SAE_HEX_LEN rule. Per the commit message, the goal is to stop arbitrarily large passwords.
• CVE-2023-40120 · platform/frameworks/base
  SystemUI's MediaDataManager now treats blank (not only null) media titles as missing, falls through the existing fallbacks, and finally substitutes a new placeholder string "<app name> is running" when no title source is non-blank.
• CVE-2023-40121 · platform/frameworks/base
  Rewrites DatabaseUtils.appendEscapedSQLString to walk every UTF-16 code unit, keep only well-formed surrogate pairs, drop unpaired (lone) high or low surrogates, and escape single quotes. Before the fix it appended the raw string verbatim when the string had no single quote.
• CVE-2023-40125 · platform/packages/apps/Settings
  Adds a user-restriction gate to ApnEditor.onCreate in Settings so the APN editor finishes immediately when the current user is not an admin or carries the DISALLOW_CONFIG_MOBILE_NETWORKS restriction.
• CVE-2023-40127 · platform/packages/providers/MediaProvider: MediaProvider.call() SCAN_FILE_CALL handling
  Canonicalizes the caller-supplied file path in MediaProvider's SCAN_FILE_CALL handler and in ModernMediaScanner's public scanFile(), scanDirectory() and onDirectoryDirty() entry points, so that non-canonical paths ("..", symlinks) are not scanned as-is under MediaProvider's cleared calling identity.
• CVE-2023-40131 · platform/frameworks/native
  Converts the two detached async-initialization threads spawned in the GpuService constructor into owned std::thread members and adds a GpuService destructor that joins them, so the threads can no longer run against a destroyed GpuService object.
• CVE-2023-40140 · platform/frameworks/base
  android_view_InputDevice_create now gives the Java KeyCharacterMap a copy of the native KeyCharacterMap (std::make_shared<KeyCharacterMap>(*map)) instead of the shared_ptr it shares with the native InputDeviceInfo, so Java-side reads no longer hit the same instance that native code can modify.
• CVE-2023-4863 · platform/external/webp
  The fixed-size HuffmanCode buffers in the VP8L (lossless WebP) decoder are replaced with a chained HuffmanTables segment structure. VP8LBuildHuffmanTable now does a dry run of BuildHuffmanTable to compute the exact table size and allocates a new segment when the current one is too small, so Huffman tables are no longer written past the allocated buffer.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).