EUVD-2026-63427
GHSA-jqhr-c9q5-h984
Severity by source
AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Physical proximity mandated by NMEA hardware interface; AC:H reflects mandatory exploit chaining; C/I/A:L scoped to gpsd process only.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of NMEA data by the gpsd daemon. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the gpsd daemon. Was ZDI-CAN-29060.
AnalysisAI
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd daemon's NMEA data processing, requiring the attacker to be physically present with the device. The flaw (CWE-120) stems from the absence of length validation before copying externally supplied NMEA input into a fixed-size stack or heap buffer within gpsd. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be physically present with the Sony XAV-9500ES device - remote exploitation is not possible given the CVSS AV:P metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall real-world risk of CVE-2026-18280 is low to moderate in absolute terms but warrants attention in fleet or high-value vehicle deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the firmware update published by Sony via the official support page at https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xav 9500Es
View allRemote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacke
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enab
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes devic
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a craf
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today