Xav Ax8500 Firmware CVE-2025-5478

This vulnerability presents a HIGH real-world risk despite no publicly disclosed EPSS or KEV status data being provided. Risk factors: (1) CVSS 8.8 is justified—attack vector is Adjacent (AV:A), not Network, but Bluetooth range is ubiquitous and requires no privileges (PR:N) or user interaction (UI:N), with high confidentiality, integrity, and availability impact (C:H/I:H/A:H); (2) The automotive infotainment domain makes this particularly dangerous—compromised vehicles could enable tracking, theft, safety system manipulation, or lateral movement to CAN bus controls; (3) Integer overflow + buffer overflow is a well-understood, reliably exploitable class of vulnerability with high technical impact; (4) Lack of authentication lowers exploitation barriers significantly; (5) Bluetooth SDP is a standard protocol, making generic tooling applicable. However, the Adjacent attack vector (not Network) provides modest friction—attacker must be physically near the vehicle. Without confirmed KEV/CISA status, active exploitation data, or public POC availability, this appears to be in early disclosure phase. Remediation priority should be HIGH for automotive OEMs and owners; patch deployment urgency depends on Sony's advisory timeline.

A threat actor with physical proximity to a Sony XAV-AX8500-equipped vehicle (e.g., in a parking lot, parking garage, or during traffic) pairs a rogue Bluetooth device or sends crafted SDP service discovery request frames containing a malicious length field in an attribute descriptor. The integer overflow causes the buffer allocation to request a very small heap region (e.g., 256 bytes instead of the intended 65,536 bytes). The attacker then sends the corresponding SDP response or attribute data, overflowing the small heap buffer and overwriting adjacent memory structures (function pointers, heap metadata, or privilege escalation gadgets). The attacker achieves arbitrary code execution in the Bluetooth daemon context, initially running as root due to the IVI system's architecture. From there, the attacker could establish persistence, exfiltrate vehicle data (location, owner information), manipulate infotainment settings, or potentially pivot to vehicle CAN bus systems if the IVI unit shares memory or process space with vehicle control systems. Attack complexity is Low (AC:L) because the overflow is triggered by simply sending a single malformed Bluetooth packet; no race conditions, timing, or additional user actions are required. No public POC is noted, suggesting this is pre-disclosure or early post-disclosure.