CVE-2026-18279
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Vulnerability in Sony XAV-9500ES device in handling of RTSP SETUP packets allows remote code execution via buffer overflow. Lack of length validation before copying data to a fixed-length buffer. Authentication is not required.
Risk Assessment
A network-adjacent attacker can execute arbitrary code in the context of the device without authentication, potentially leading to device takeover.
Recommendation
Update the device firmware and restrict network access to the device.
Other vulnerabilities in Sony XAV-9500ES
See all- CVE-2026-18284High
Vulnerability in Sony XAV-9500ES device in crash dump handling allows local privilege escalation via command injection. Lack of string validation before using it in a system call. Requires low-privileged access to the system.
- CVE-2026-18283Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.
- CVE-2026-18282High
Vulnerability in Sony XAV-9500ES device in AVRCP_Br_Response_Parser allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18281High
Vulnerability in Sony XAV-9500ES device in l2_reassemble_sdu allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18280Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.
- CVE-2026-18278Low
A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.
Original NVD description (English source)
Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SETUP RTSP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29042.