CVE-2026-18282
Received Received - Intake

Heap-based Buffer Overflow in Sony XAV-9500ES

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of AVRCP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28995.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18282
EUVD
EUVD-2026-63429

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sony xav-9500es *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow vulnerability in the Sony XAV-9500ES device. It allows remote code execution when an attacker pairs a malicious Bluetooth device with the target system. The flaw occurs due to improper validation of user-supplied data length in AVRCP packets, leading to a heap buffer overflow.

Detection Guidance

Detection requires monitoring for unauthorized Bluetooth pairing attempts or unusual AVRCP packet handling. Check device logs for unexpected Bluetooth connections or crashes during media control operations. No specific commands are provided in the available resources.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary code on your Sony XAV-9500ES device. This could allow unauthorized access, control of the device, or potential compromise of connected systems if the device is part of a larger network.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a heap-based buffer overflow in a Sony XAV-9500ES device allowing remote code execution via Bluetooth pairing. Compliance impacts would depend on how the device is used in a system handling personal or health data.

Mitigation Strategies

Apply the firmware update released by Sony to fix the heap-based buffer overflow. Disable Bluetooth pairing unless necessary and restrict access to trusted devices. Monitor for suspicious Bluetooth activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart