CVE-2026-18281
Received Received - Intake

Heap-based Buffer Overflow in Sony XAV-9500ES

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29072.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18281
EUVD
EUVD-2026-63428

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sony xav-9500es *
sony xav-9500es to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow vulnerability in the Sony XAV-9500ES device. It occurs when handling Bluetooth L2CAP packets due to insufficient validation of user-supplied data length before copying it to a heap-based buffer. An attacker can exploit this to execute arbitrary code on the device by first pairing a malicious Bluetooth device with the target system.

Detection Guidance

Detection requires monitoring for unusual Bluetooth pairing attempts or unexpected L2CAP packet handling. Check device logs for unauthorized Bluetooth connections or crashes in the Sony XAV-9500ES system. Use network monitoring tools to inspect Bluetooth traffic for malformed packets targeting L2CAP channels.

Impact Analysis

An attacker could gain control of your Sony XAV-9500ES device, potentially accessing sensitive data, altering system behavior, or causing the device to malfunction. Since the device is likely an in-car infotainment system, this could also affect vehicle functionality and safety.

Compliance Impact

This vulnerability could lead to unauthorized code execution on affected Sony XAV-9500ES devices, potentially allowing attackers to access sensitive data or disrupt operations. For GDPR, this may result in unauthorized data processing or breaches. For HIPAA, it could expose protected health information if the device handles such data.

Mitigation Strategies

Apply the latest firmware update from Sony to patch the heap-based buffer overflow. Disable Bluetooth pairing unless absolutely necessary. Restrict physical access to the device to prevent unauthorized pairing attempts. Monitor for any signs of exploitation or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart