CVE-2024-53197

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 4 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

2.09%

probability

This CVE has a 2.09% probability of being exploited in the next 30 days.

0% Top 84.2th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

OOB free in ALSA USB

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write

Google Project Zero

Discovered

Nov. 20, 2024

Patched

April 1, 2025

Reported by

Benoît Sevens of Google's Threat Analysis Group

Root Cause Analysis

???

Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities

TheHackerNews

Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities

TheHackerNews

Google fixes Android zero-days exploited in attacks, 60 other flaws

BleepingComputer Apr 07, 2025

Serbian police used Cellebrite zero-day hack to unlock Android phones

BleepingComputer Feb 28, 2025

Signal Intelligence

Confidenceⓘ

78%

EPSS 2.09%

Mentions 4

Last Seen Apr 07, 2025

CNA Information

Analyst Note

CVE-2024-53197 is confirmed as a legitimate kernel vulnerability affecting USB audio devices, with a HIGH CVSS score (7.8) and documented in Google Project Zero, indicating credible security research. The vulnerability involves a memory safety issue (out-of-bounds access) in ALSA USB audio handling for specific device models, which is a well-understood attack vector in kernel code. While not yet in CISA's KEV catalog, the Google Project Zero attribution and availability of fix patches support the confirmed classification.