CVE-2026-18284
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Vulnerability in Sony XAV-9500ES device in crash dump handling allows local privilege escalation via command injection. Lack of string validation before using it in a system call. Requires low-privileged access to the system.
Risk Assessment
An attacker can escalate privileges to root and execute arbitrary code, potentially leading to full device compromise.
Recommendation
Update the device firmware and restrict local access to the system.
Other vulnerabilities in Sony XAV-9500ES
See all- CVE-2026-18283Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.
- CVE-2026-18282High
Vulnerability in Sony XAV-9500ES device in AVRCP_Br_Response_Parser allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18281High
Vulnerability in Sony XAV-9500ES device in l2_reassemble_sdu allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18280Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.
- CVE-2026-18279High
Vulnerability in Sony XAV-9500ES device in handling of RTSP SETUP packets allows remote code execution via buffer overflow. Lack of length validation before copying data to a fixed-length buffer. Authentication is not required.
- CVE-2026-18278Low
A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.
Original NVD description (English source)
Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of process crash dumps. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29061.