Xav 9500Es
Monthly
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged code execution to escalate to root via the device's crash dump handler. The handler passes user-controlled input directly to an OS system call without sanitization (CWE-78), enabling arbitrary command execution at the highest privilege level. Disclosed by ZDI as ZDI-26-477 (ZDI-CAN-29061); no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a crafted USB device that triggers instantiation of otherwise restricted USB device types, circumventing the unit's udev-based authorization controls. Firmware version 3.02.00 of the XAV-9500ES is confirmed affected per EUVD-2026-63430. The CVSS 3.0 score of 2.4 reflects the strict physical access requirement and low integrity-only impact; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacker who can induce a victim to pair a malicious Bluetooth device. The root cause is a heap-based buffer overflow (CWE-122) in the AVRCP_Br_Response_Parser function, which fails to validate the length of attacker-controlled data before copying it into a heap allocation. Successful exploitation yields arbitrary code execution at the device level; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd daemon's NMEA data processing, requiring the attacker to be physically present with the device. The flaw (CWE-120) stems from the absence of length validation before copying externally supplied NMEA input into a fixed-size stack or heap buffer within gpsd. Exploitation requires chaining with at least one additional vulnerability to achieve meaningful code execution, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's RTSP server, exploitable by unauthenticated network-adjacent attackers without user interaction. Sending a crafted RTSP SETUP packet with an oversized field overflows a fixed-length buffer, corrupting memory and enabling arbitrary code execution in the device's context. Discovered and reported by Zero Day Initiative (ZDI-CAN-29042 / ZDI-26-472), a Sony vendor advisory and firmware update are available for affected firmware version 3.02.00; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes device memory contents to network-adjacent attackers over Bluetooth. Exploitation requires a malicious Bluetooth device to be paired with the target unit, after which crafted L2CAP packets trigger a read past the end of an allocated buffer, leaking sensitive memory. While the standalone impact is information disclosure, ZDI notes this vulnerability can be chained with additional flaws to achieve arbitrary code execution on the device; no public exploit identified at time of analysis.
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged code execution to escalate to root via the device's crash dump handler. The handler passes user-controlled input directly to an OS system call without sanitization (CWE-78), enabling arbitrary command execution at the highest privilege level. Disclosed by ZDI as ZDI-26-477 (ZDI-CAN-29061); no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a crafted USB device that triggers instantiation of otherwise restricted USB device types, circumventing the unit's udev-based authorization controls. Firmware version 3.02.00 of the XAV-9500ES is confirmed affected per EUVD-2026-63430. The CVSS 3.0 score of 2.4 reflects the strict physical access requirement and low integrity-only impact; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacker who can induce a victim to pair a malicious Bluetooth device. The root cause is a heap-based buffer overflow (CWE-122) in the AVRCP_Br_Response_Parser function, which fails to validate the length of attacker-controlled data before copying it into a heap allocation. Successful exploitation yields arbitrary code execution at the device level; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd daemon's NMEA data processing, requiring the attacker to be physically present with the device. The flaw (CWE-120) stems from the absence of length validation before copying externally supplied NMEA input into a fixed-size stack or heap buffer within gpsd. Exploitation requires chaining with at least one additional vulnerability to achieve meaningful code execution, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's RTSP server, exploitable by unauthenticated network-adjacent attackers without user interaction. Sending a crafted RTSP SETUP packet with an oversized field overflows a fixed-length buffer, corrupting memory and enabling arbitrary code execution in the device's context. Discovered and reported by Zero Day Initiative (ZDI-CAN-29042 / ZDI-26-472), a Sony vendor advisory and firmware update are available for affected firmware version 3.02.00; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes device memory contents to network-adjacent attackers over Bluetooth. Exploitation requires a malicious Bluetooth device to be paired with the target unit, after which crafted L2CAP packets trigger a read past the end of an allocated buffer, leaking sensitive memory. While the standalone impact is information disclosure, ZDI notes this vulnerability can be chained with additional flaws to achieve arbitrary code execution on the device; no public exploit identified at time of analysis.