CVE-2024-48336

8.4 highEPSS 0.5%

High (8.4). EPSS 0.5% chance of exploitation in the next 30 days.

The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation.

Severity

CVSS 3.1

8.4 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-829
Published: 2024-11-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/canyie/MagiskEoP
https://github.com/topjohnwu/Magisk/commit/c2eb6039579b8a2fb1e11a753cea7662c07bec02

Check your stack JSON