EUVD-2026-63425
GHSA-vv43-p65q-97r5
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Adjacent Bluetooth vector requires physical proximity; user must accept pairing (UI:R); OOB read yields partial memory disclosure only, with no integrity or availability impact.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-28990.
AnalysisAI
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes device memory contents to network-adjacent attackers over Bluetooth. Exploitation requires a malicious Bluetooth device to be paired with the target unit, after which crafted L2CAP packets trigger a read past the end of an allocated buffer, leaking sensitive memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be physically within Bluetooth communication range of the target vehicle (typically 10-100 metres depending on Bluetooth class). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 3.5 (Low) accurately reflects the constrained attack surface: adjacent-only access (Bluetooth range of roughly 10-100 metres), mandatory user interaction for device pairing, and a confidentiality-only impact with no integrity or availability consequence from the OOB read alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Sony XAV-9500ES firmware support page at https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922 for any updated firmware that addresses this vulnerability; a specific patched firmware version number is not confirmed in the available input data, so the advisory page must be checked directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xav 9500Es
View allRemote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacke
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enab
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd da
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a craf
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today