---
id: "CVE-2024-29745"
kind: "vulnerability"
aliases: ["CVE-2024-29745"]
title: "google android: there is a possible Information Disclosure due to uninitialized data"
severity: "medium"
cvss: 5.5
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Android Pixel", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "google android", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "exploited", "fleet-devices", "infrastructure", "pixel"]
not_affected_if: ["non-pixel-devices"]
published_at: "2024-04-04T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-29745", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29745", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# google android: there is a possible Information Disclosure due to uninitialized data

An information disclosure flaw exists in the fastboot firmware on Android Pixel devices, the component used for unlocking, flashing and locking the device. An attacker with physical or local access to a device could read data they should not see, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Android Pixel affected ? fixed ?
- vendor:google android affected ? fixed ?

## Fix

Apply mitigations per vendor instructions, as CISA requires; the sources do not name a patched build.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-29745
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-29745

## From the sources

Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_