Sony XAV-9500ES CVE-2026-18281

Exploitation requires two specific preconditions: (1) the attacker must be within Bluetooth range of the target device (typically ~10 meters), and (2) the victim must actively pair a malicious Bluetooth device with the XAV-9500ES - this is not a passive eavesdropping attack and cannot be triggered by proximity alone. The pairing requirement (UI:R) is the primary exploitation barrier; social engineering or device impersonation is necessary to induce the pairing event. Once pairing is established, no further user interaction or authentication is required to send the malicious L2CAP packets. Limiting factors include: physical proximity constraint (Bluetooth range), the need for victim participation in pairing, and the niche deployment of this specific car head unit model.

The CVSS 3.0 base score of 8.0 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack surface: adjacent network only (Bluetooth range, typically ~10m), low complexity once paired, and full confidentiality/integrity/availability impact. The primary gating factor is the UI:R requirement - a victim must actively pair their device with a malicious Bluetooth device controlled by the attacker, which significantly raises the real-world bar compared to a zero-interaction adjacent attack. No EPSS data was provided in the intelligence feed; without it, exploitation probability cannot be quantitatively benchmarked. The absence of a CISA KEV listing and no reported POC code suggest this is not yet being exploited at scale. The attack is geographically constrained to Bluetooth range and socially constrained to pairing acceptance, making mass exploitation unlikely - but the vulnerability is highly relevant in targeted scenarios such as vehicle theft, physical proximity surveillance, or automotive security research contexts. Risk is moderate-to-high for targeted individuals but low for broad-scale campaigns.

An attacker parks near a target vehicle, advertises a Bluetooth device with a convincing name (e.g., impersonating a known device like 'iPhone' or 'Headphones') to lure the driver into initiating a pairing from the XAV-9500ES. Once the bond is established, the attacker transmits specially crafted L2CAP SDU fragments with a manipulated length field that overflows the heap buffer in l2_reassemble_sdu, redirecting execution flow to attacker-controlled code running in the context of the head unit's firmware. No public POC has been identified, but ZDI's disclosure of ZDI-CAN-29072 as ZDI-26-474 indicates the vulnerability has been validated and reproduced.