EUVD-2026-63429
GHSA-h92r-xj8g-2xqw
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent Bluetooth vector with no required attacker privileges; victim pairing acceptance drives UI:R; full impact triad reflects arbitrary code execution on the head unit.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of AVRCP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28995.
AnalysisAI
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacker who can induce a victim to pair a malicious Bluetooth device. The root cause is a heap-based buffer overflow (CWE-122) in the AVRCP_Br_Response_Parser function, which fails to validate the length of attacker-controlled data before copying it into a heap allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be within Bluetooth radio range of the target vehicle (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 score of 8.0 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly captures the two primary constraints on exploitation: adjacency is restricted to Bluetooth radio range, and user interaction is mandatory because the victim must accept or initiate a pairing request with the attacker's malicious device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update documented in the Sony XAV-9500ES support advisory at https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployed Sony XAV-9500ES units to determine fleet exposure and develop an affected asset list by location and vehicle. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xav 9500Es
View allRemote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enab
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd da
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes devic
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a craf
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today