Kenwood DNR1007XR CVE-2026-18269

Physical presence at the target device is required - the CVSS vector AV:P confirms this is not remotely exploitable. No authentication is required once physical access is obtained. Exploitation is triggered through the device's media parsing subsystem, requiring the attacker to supply a crafted input (e.g., a malformed media file on USB or SD card) that reaches the tchdr_bytestream_read function. No special device configuration or non-default settings appear necessary based on available data. Limiting factors: the attacker must have unobstructed physical access to the device's media input ports, and exploitation depends on the firmware executing the vulnerable bytestream parsing routine on the supplied input. Remote or network-based exploitation is not possible given the physical vector.

The CVSS 3.0 base score of 6.8 reflects a physical attack vector (AV:P), low complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The physical vector is the dominant risk-limiting factor: exploitation requires an attacker to have hands-on access to the target vehicle's infotainment unit, which dramatically reduces the realistic threat population compared to network-exploitable vulnerabilities. No EPSS data was provided, but given the AV:P constraint and niche device category, opportunistic mass exploitation is implausible. No KEV listing confirms active exploitation. The ZDI disclosure (ZDI-CAN-28980) through a structured coordinated disclosure process suggests this was researcher-discovered rather than actively abused. The primary realistic threat scenario involves physical tampering - theft of the device, service center access, or a motivated adversary with vehicle access. Despite the moderate CVSS score, defenders should treat the physical access requirement as the effective security boundary.

An attacker with physical access to the vehicle - such as a valet, mechanic, or opportunistic thief - inserts a specially crafted USB drive or SD card containing a malicious media file. When the Kenwood DNR1007XR processes the file, the tchdr_bytestream_read function writes past the end of an allocated buffer, corrupting adjacent memory and redirecting execution flow to attacker-controlled code running as root. No public proof-of-concept has been identified at time of analysis, but the ZDI coordinated disclosure implies a functional exploit was demonstrated to the vendor.