CVE-2026-18278
Received Received - Intake

Out-of-Bounds Read in Sony XAV-9500ES via Bluetooth L2CAP

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-28990.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18278
EUVD
EUVD-2026-63425

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sony xav-9500es *
sony xav-9500es to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Out-Of-Bounds Read Information Disclosure vulnerability in Sony XAV-9500ES devices. It occurs when the system fails to properly validate Bluetooth L2CAP packets, causing it to read past the end of an allocated buffer. This allows network-adjacent attackers to access sensitive information if they can pair a malicious Bluetooth device with the target system.

Detection Guidance

Detection requires monitoring for unusual Bluetooth pairing attempts or L2CAP packet handling anomalies. Check device logs for unauthorized Bluetooth connections or unexpected buffer read errors. Use network scanning tools to identify unpatched Sony XAV-9500ES devices.

Impact Analysis

An attacker could exploit this to disclose sensitive information from your Sony XAV-9500ES device. They would need to be within Bluetooth range and pair a malicious device first. While this alone doesn't allow code execution, it could be combined with other vulnerabilities to further compromise the system.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate compliance requirements under GDPR or HIPAA if personal or health information is exposed. Organizations using affected devices should apply the available update to mitigate risks.

Mitigation Strategies

Apply the official firmware update from Sony to patch the vulnerability. Disable Bluetooth pairing for untrusted devices. Monitor for suspicious Bluetooth activity and restrict network access to the device until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart