CVE-2024-53104

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 9 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

13.22%

probability

This CVE has a 13.22% probability of being exploited in the next 30 days.

0% Top 94.2th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

OOB write in uvcvideo

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write

Google Project Zero

Discovered

Nov. 7, 2024

Patched

Feb. 1, 2025

Reported by

Benoît Sevens of Google's Threat Analysis Group

Root Cause Analysis

???

Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities

TheHackerNews

Google Patches 47 Android Security Flaws, Including Actively Exploited CVE-2024-53104

TheHackerNews

Google fixes Android kernel zero-day exploited in attacks

BleepingComputer Feb 03, 2025

Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities

TheHackerNews

Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products

TheHackerNews

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [10 February]

TheHackerNews

Google fixes Android zero-days exploited in attacks, 60 other flaws

BleepingComputer Apr 07, 2025

Google fixes Android zero-day exploited by Serbian authorities

BleepingComputer Mar 04, 2025

Serbian police used Cellebrite zero-day hack to unlock Android phones

BleepingComputer Feb 28, 2025

Signal Intelligence

Confidenceⓘ

82%

EPSS 13.22%

Mentions 9

Last Seen Apr 07, 2025

CNA Information

Analyst Note

CVE-2024-53104 is confirmed as a real vulnerability in the Linux kernel's uvcvideo driver involving out-of-bounds writes due to improper frame type parsing. The fix has been merged upstream, and the HIGH severity CVSS score (7.8) reflects the potential for memory corruption attacks, supported by multiple credible news sources documenting the issue.