January 2025: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 12 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r16 adds the fix for 11 CVEs: CVE-2024-34722, CVE-2024-49724, CVE-2024-49733, CVE-2024-49734, CVE-2024-49736, CVE-2024-49737, CVE-2024-49738, CVE-2024-49742, CVE-2024-49744, CVE-2024-49745, CVE-2024-49749.

android-security-15.0.0_r4 adds the fix for 10 CVEs: CVE-2024-49724, CVE-2024-49732, CVE-2024-49733, CVE-2024-49735, CVE-2024-49737, CVE-2024-49738, CVE-2024-49742, CVE-2024-49744, CVE-2024-49745, CVE-2024-49749.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

These fixes carry a different trace from the bulletin's commit (another bug id, no Bug line, a merge), and were matched by content. Similarity is the share of the reference's changed lines found in the commit.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 15: 1 fix in android-security-15.0.0_r4

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-34722 · platform/packages/modules/Bluetooth
  Adds a new SMP control-block flag, SMP_PAIR_FLAGS_CMD_CONFIRM_SENT, which is set when the local Pairing Confirm is sent. smp_proc_init and smp_proc_rand now reject a peer rand received in BLE legacy pairing before the local confirm was sent, and fail the pairing with SMP_INVALID_PARAMETERS.
• CVE-2024-34730 · platform/packages/modules/Bluetooth
  Adds a per-device "reconnect_allowed" flag to the HID host btif layer (persisted as HidReConnectAllowed) and makes hh_open_handler in system/btif/src/btif_hh.cc reject incoming HID connections unless the device is an added device with reconnection allowed or an outgoing connection to it is pending.
• CVE-2024-43095 · platform/packages/modules/Permission
  PermissionController now treats a platform permission group as granted (and eligible for whole-group auto-grant) only when a permission in that group defined by the platform or a system app is granted, or when all permissions in the group were auto-granted (REVOKE_WHEN_REQUESTED). Grants of permissions defined by other apps that sit in a platform group no longer count.
• CVE-2024-43096 · platform/packages/modules/Bluetooth
  Adds an mtu == 0 rejection at the top of build_read_multi_rsp in system/stack/gatt/gatt_sr.cc and clamps the EATT channel tx MTU to at least EATT_MIN_MTU_MPS in EattChannel::EattChannelSetTxMTU, so the Read Multiple response buffer is never allocated with zero payload room before the opcode byte is written.
• CVE-2024-43763 · platform/packages/modules/Bluetooth
  Changes the early-exit condition in build_read_multi_rsp (system/stack/gatt/gatt_sr.cc) so a zero-length attribute value is encoded into the GATT Read Multiple (Variable) response instead of terminating the response builder and producing a truncated or empty packet.
• CVE-2024-43765 · platform/packages/apps/DocumentsUI
  DocumentsUI now declares android.permission.HIDE_OVERLAY_WINDOWS and calls Window.setHideOverlayWindows(true) on every BaseActivity window and on the ConfirmFragment dialog window (on S+), so non-system overlay windows are hidden over the picker UI.
• CVE-2024-43770 · platform/packages/modules/Bluetooth
  Adds early returns in four GATT server request handlers in system/stack/gatt/gatt_sr.cc when gatt_tcb_get_payload_size_tx() returns 0 (channel already closed), so response buffers are no longer allocated with a zero payload size and written past their end.
• CVE-2024-43771 · platform/packages/modules/Bluetooth
  Adds early-return checks for a zero payload size (returned by gatt_tcb_get_payload_size_tx when the channel is already closed) in four ATT server request handlers in system/stack/gatt/gatt_sr.cc. This stops undersized response buffers from being allocated and written out of bounds.
• CVE-2024-49724 · platform/frameworks/base
  Hardens AccountManagerService's validation of an authenticator-supplied KEY_INTENT. After the target activity passes the signature/exported-system check, the intent is explicitly pinned to the resolved component and written back into the result bundle. The exact Intent class check in checkKeyIntentParceledCorrectly now applies to both the original and the re-parceled intent.
• CVE-2024-49732 · platform/frameworks/base
  Adds a system-UID caller check to the three hidden permission-sync binder entry points (enablePermissionsSync, disablePermissionsSync, getPermissionSyncRequest) in CompanionDeviceManagerService, so that non-system callers get a SecurityException instead of reaching SystemDataTransferProcessor.
• CVE-2024-49733 · platform/frameworks/base
  ServiceListing.reload() in SettingsLib now always includes every component already approved in the backing Settings.Secure setting (queried explicitly by ComponentName), instead of only listing services that currently match the intent action, declared permission and validator, so previously approved services no longer disappear from the list given to callbacks.
• CVE-2024-49734 · platform/packages/modules/Connectivity (ConnectivityService
  ConnectivityService now installs ingress discard rules (via mBpfNetMaps.setIngressDiscardRule) so that packets to an address used only by a VPN interface are dropped when they arrive on a non-VPN interface. Two frameworks/libs/net changes accompany it and keep IPv4-mapped IPv6 addresses as Inet6Address.
• CVE-2024-49735 · platform/frameworks/base
  Caps the size of vibration data stored on a NotificationChannel by truncating vibration patterns to 500 entries, cropping non-repeating composed VibrationEffects (new VibrationEffect.cropToLengthOrNull) or dropping effects whose serialized form exceeds 32,768 characters, and no longer serializing a VibrationEffect to XML when an equivalent pattern already exists.
• CVE-2024-49736 · platform/packages/apps/Settings
  Settings' factory reset screen (MainClear) now checks DynamicSystemManager.isInUse() before keyguard confirmation. If a Dynamic System Update image is in use, it shows an informational AlertDialog (R.string.dsu_is_running) and returns instead of continuing with the reset flow.
• CVE-2024-49737 · platform/frameworks/base
  In WindowOrganizerController, the OP_TYPE_START_ACTIVITY_IN_TASK_FRAGMENT handler now builds a SafeActivityOptions from the operation's options Bundle using the actual caller's pid/uid (caller.mPid, caller.mUid), and ActivityStartController.startActivityInTaskFragment now takes that SafeActivityOptions instead of a raw Bundle.
• CVE-2024-49738 · platform/frameworks/native
  In libbinder Parcel.cpp, writeInplace(), writeObject() and writeAligned() now call validateReadData() on the end offset of the write before storing into mData+mDataPos, and refuse the write if it fails.
• CVE-2024-49742 · platform/packages/apps/Settings
  NotificationAccessConfirmationActivity in Settings now verifies, before showing the grant dialog, that the requesting package declares a service resolving the NotificationListenerService intent action for the target user and that this service is protected by BIND_NOTIFICATION_LISTENER_SERVICE, finishing the activity otherwise, and it drops the onBackPressed override that prevented dismissal.
• CVE-2024-49744 · platform/frameworks/base
  Hardens AccountManagerService.checkKeyIntent so that an authenticator-supplied KEY_INTENT is pinned to the activity component the system resolved and validated, and extends the Intent-subclass check in checkKeyIntentParceledCorrectly to the re-parceled copy.
• CVE-2024-49745 · platform/frameworks/native
  Parcel::growData in libbinder now rejects a grow request with BAD_VALUE when the current data position is beyond the data size, instead of going ahead with growth that per the commit message used to abort or could request a very large allocation.
• CVE-2024-49747 · platform/packages/modules/Bluetooth
  Adds an early return in four GATT server request handlers in system/stack/gatt/gatt_sr.cc when the transmit payload size returned for the channel is 0 (channel already closed), so a response buffer sized from that zero length is never allocated and written past.
• CVE-2024-49748 · platform/packages/modules/Bluetooth
  Adds an early return in four GATT server request handlers in system/stack/gatt/gatt_sr.cc when the per-channel transmit payload size is 0 (channel already closed). As a result, a response buffer with effectively zero payload space is no longer allocated and written into.
• CVE-2024-49749 · platform/external/giflib
  Replaces a broken (effectively dead) overflow check in DGifSlurp with a correct one that rejects non-positive or overflowing ImageDesc.Width * ImageDesc.Height before RasterBits is allocated.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).