September 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 25 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r12 adds the fix for 9 CVEs: CVE-2024-32896, CVE-2024-40650, CVE-2024-40652, CVE-2024-40655, CVE-2024-40656, CVE-2024-40657, CVE-2024-40658, CVE-2024-40659, CVE-2024-40662.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

No security tag this month.

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-32896 · platform/frameworks/base
  RecoverySystemService.rebootRecoveryWithCommand() now destroys all KeyMint keys via the new AndroidKeyStoreMaintenance.deleteAllKeys() (IKeystoreMaintenance.deleteAllKeys) before rebooting to recovery when the command contains "--wipe_data", with a matching SELinux allow for system_server, so FBE-encrypted data becomes unrecoverable even if the recovery data wipe is interrupted or skipped.
• CVE-2024-40650 · platform/packages/apps/Settings
  Adds android:maxLength=500 to the wifi_item_edit_content style in Settings res/values/styles.xml, so edit fields using that style (the commit tests it on "Add network") accept at most 500 characters.
• CVE-2024-40652 · platform/packages/apps/Settings
  SettingsHomepageActivity.onCreate now reads Settings.Global.DEVICE_PROVISIONED and immediately finishes the activity when the device is not yet provisioned, so the Settings homepage cannot be used before setup completes.
• CVE-2024-40654 · platform/packages/apps/Settings
  SearchResultTrampoline now identifies its launcher with getLaunchedFromPackage() instead of getCallingActivity(), and SearchFeatureProvider.verifyLaunchSearchResultPageCaller now takes the launching package name instead of the result-receiving ComponentName.
• CVE-2024-40655 · platform/packages/services/Telecomm
  Adds an unbindService() call to the call-screening timeout handler in Telecom's CallScreeningServiceHelper so that a CallScreeningService that never responds is released after the timeout instead of staying bound.
• CVE-2024-40656 · platform/packages/services/Telecomm
  Adds a cross-user validation of the StatusHints icon carried by a ParcelableConference in ConnectionServiceWrapper's handleCreateConferenceComplete callback. It uses the Binder calling user, captured before the calling identity is cleared.
• CVE-2024-40657 · platform/packages/apps/Settings
  Settings' AccountTypePreferenceLoader now neutralizes clicks on any preference inflated from an external account authenticator's accountPreferences XML whose android:fragment is not already present in the host preference group, so that external apps cannot have Settings open its internal fragments.
• CVE-2024-40658 · platform/frameworks/av
  Adds a size consistency check in SoftVideoDecoderOMXComponent::getConfig for kDescribeHdr10PlusInfoIndex. It rejects a client-supplied nParamSize larger than the trailing storage described by nSize, before the HDR10+ info is memcpy'd into outParams->nValue.
• CVE-2024-40659 · platform/packages/modules/RemoteKeyProvisioning (rkpdapp
  Restricts the exported rkpdapp RemoteProvisioningService so that only system_server (SYSTEM_UID) or rkpdapp itself can use the getRegistration API. It does this by adding a BIND_RKP_SERVICE permission to the service in the manifest and a calling-UID check in the binder implementation.
• CVE-2024-40662 · platform/frameworks/base
  Uri.Builder.scheme(String) in android.net.Uri now removes every "://" sequence from a non-null scheme before storing it, so a caller-supplied scheme can no longer carry that scheme delimiter into the built Uri.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).