Arbitrary Code execution in Car App Android Jetpack Library
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Android | 1.4.0 to before 1.7.0-beta02 | 1.7.0-beta02 | Patch available | CNA |
- Android VendorGoogle Affected 1.4.0 to before 1.7.0-beta02 Fixed in 1.7.0-beta02 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:google:androidx.car.app:*:*:*:*:*:*:*:* | up to 1.4.0 | Vulnerable | |
| cpe:2.3:a:google:androidx.car.app:1.7.0:alpha01:*:*:*:*:*:* | 1.7.0 alpha01 | Vulnerable | |
| cpe:2.3:a:google:androidx.car.app:1.7.0:alpha02:*:*:*:*:*:* | 1.7.0 alpha02 | Vulnerable | |
| cpe:2.3:a:google:androidx.car.app:1.7.0:beta01:*:*:*:*:*:* | 1.7.0 beta01 | Vulnerable |
- cpe:2.3:a:google:androidx.car.app:*:*:*:*:*:*:*:* Versions up to 1.4.0 Vulnerable ·Google
- cpe:2.3:a:google:androidx.car.app:1.7.0:alpha01:*:*:*:*:*:* Versions 1.7.0 alpha01 Vulnerable ·Google
- cpe:2.3:a:google:androidx.car.app:1.7.0:alpha02:*:*:*:*:*:* Versions 1.7.0 alpha02 Vulnerable ·Google
- cpe:2.3:a:google:androidx.car.app:1.7.0:beta01:*:*:*:*:*:* Versions 1.7.0 beta01 Vulnerable ·Google
Remediation
- Fix · CNA Android (Google) Fixed in 1.7.0-beta02
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10382
- 2026-10-03 Alias added: GHSA-pq4w-jf35-7pmx
Sources
- CVE-2024-10382 · CVE Program
- CVE-2024-10382 · NVD
- FIRST EPSS
- GHSA-pq4w-jf35-7pmx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences