Sony XAV-9500ES EUVD-2026-63426

The attacker must be network-adjacent to the target device - on the same Wi-Fi network or local network segment as the XAV-9500ES (CVSS AV:A). No authentication credentials are required (PR:N per CVSS). The device must be powered on with its RTSP service active and network-reachable. No user interaction is required on the victim's side (UI:N). Exploitation is bounded by the adjacent-only attack vector: internet-based attackers cannot reach the device directly without first compromising the vehicle's local network or a connected access point. The RTSP service must be reachable on the network; if the device operates on a private, isolated, or password-protected Wi-Fi network without untrusted participants, the realistic threat is substantially reduced.

The CVSS 3.0 score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H accurately captures the severity: trivial to exploit (AC:L, PR:N, UI:N) with full CIA impact. The most significant mitigating factor is the Adjacent network vector (AV:A), which confines exploitation to the same network segment as the device - typically the in-vehicle Wi-Fi or a shared local network - rather than the open internet. EPSS data was not provided in the source intelligence, so exploitation probability relative to the broader CVE population cannot be quantified. The vulnerability does not appear in CISA KEV, and no public exploit code has been identified at time of analysis, suggesting it has not yet seen widespread opportunistic abuse. Real-world risk is highest in scenarios where the device's network interface is exposed to untrusted users (e.g., shared vehicle hotspot, fleet environments with multiple occupants). For personal vehicles with a private, non-shared in-car network, the practical attack surface is narrow. Sony has released a firmware patch, which is the primary risk-reduction lever.

An attacker positioned on the same Wi-Fi network or local network segment as the target vehicle - for example, a passenger using the vehicle's shared hotspot, or an attacker in proximity to an unsecured vehicle network - sends a specially crafted RTSP SETUP request to the XAV-9500ES with an oversized header value exceeding the fixed-length buffer's capacity. The resulting overflow corrupts the stack or heap, redirecting execution to attacker-controlled instructions and granting code execution as the device's media system process. No public exploit code has been identified at time of analysis, but the ZDI advisory (ZDI-26-472) provides sufficient technical context to facilitate exploit development.