CVE-2026-18280
Received Received - Intake

Buffer Overflow in Sony XAV-9500ES via gpsd

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NMEA data by the gpsd daemon. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the gpsd daemon. Was ZDI-CAN-29060.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18280
EUVD
EUVD-2026-63427

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sony xav-9500es *
sony xav-9500es to 3.9 (inc)
sony xav-9500es to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in the Sony XAV-9500ES device's gpsd daemon. It occurs when the daemon fails to properly validate the length of NMEA data before copying it to a fixed-size buffer. Physically present attackers can exploit this to execute arbitrary code without authentication.

Detection Guidance

Detecting this vulnerability requires checking for the presence of vulnerable Sony XAV-9500ES devices and inspecting the gpsd daemon for buffer overflow conditions. Use network scanning tools to identify devices running gpsd. Check the version of gpsd on affected systems. Commands like 'ps aux | grep gpsd' or 'dpkg -l | grep gpsd' may help identify the service and its version.

Impact Analysis

An attacker with physical access to the device could exploit this flaw to run malicious code, potentially gaining control over the system. This could lead to unauthorized access, data manipulation, or disruption of device functionality.

Compliance Impact

This vulnerability allows arbitrary code execution on the Sony XAV-9500ES device due to a buffer overflow in the gpsd daemon. While it does not directly impact GDPR or HIPAA compliance, unauthorized code execution could lead to data breaches or unauthorized access to sensitive information, potentially violating these regulations if personal or health data is compromised.

Mitigation Strategies

Immediately update the Sony XAV-9500ES device to the latest firmware provided by Sony to address the buffer overflow flaw. Ensure the gpsd daemon is updated to a patched version if applicable. Restrict physical access to the device to prevent exploitation. Monitor network traffic for unusual activity related to gpsd or NMEA data handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart