{"cve":"CVE-2024-10382","nvd":{"published":"2024-11-20T11:15:04.280","modified":"2026-06-17T06:55:31.653","status":"Analyzed","description":"There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber","score":7.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","score":7.5},"cwes":["CWE-502","CWE-94"],"references":["https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03"],"products":["google:androidx.car.app"],"source":"nvd","synced_at":"2026-10-19T21:57:34.731061660+00:00"},"epss":{"cve":"CVE-2024-10382","score":0.00154,"percentile":0.04531,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}