EUVD-2026-63428
GHSA-pv6v-r567-jrcx
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent Bluetooth vector, no target-side privileges needed, but victim must actively pair with attacker device (UI:R); full code execution yields C:H/I:H/A:H.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29072.
AnalysisAI
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in l2_reassemble_sdu stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific preconditions: (1) the attacker must be within Bluetooth range of the target device (typically ~10 meters), and (2) the victim must actively pair a malicious Bluetooth device with the XAV-9500ES - this is not a passive eavesdropping attack and cannot be triggered by proximity alone. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 8.0 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack surface: adjacent network only (Bluetooth range, typically ~10m), low complexity once paired, and full confidentiality/integrity/availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update published by Sony via the official support page at https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922 - users should verify the specific patched firmware version number listed there, as the exact fix version was not independently confirmed in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Sony XAV-9500ES receivers in your fleet or critical operations, review their current firmware versions, and configure Bluetooth settings to restrict pairing to pre-authorized devices or disable the feature entirely on unattended vehicles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xav 9500Es
View allRemote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacke
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd da
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes devic
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a craf
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today