CVE-2026-18281
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in Sony XAV-9500ES device in l2_reassemble_sdu allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
Risk Assessment
A network-adjacent attacker can execute arbitrary code in the context of the device, potentially leading to device takeover.
Recommendation
Update the device firmware and avoid pairing with untrusted Bluetooth devices.
Other vulnerabilities in Sony XAV-9500ES
See all- CVE-2026-18284High
Vulnerability in Sony XAV-9500ES device in crash dump handling allows local privilege escalation via command injection. Lack of string validation before using it in a system call. Requires low-privileged access to the system.
- CVE-2026-18283Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.
- CVE-2026-18282High
Vulnerability in Sony XAV-9500ES device in AVRCP_Br_Response_Parser allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18280Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.
- CVE-2026-18279High
Vulnerability in Sony XAV-9500ES device in handling of RTSP SETUP packets allows remote code execution via buffer overflow. Lack of length validation before copying data to a fixed-length buffer. Authentication is not required.
- CVE-2026-18278Low
A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.
Original NVD description (English source)
Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29072.