Out-of-Bounds Write Vulnerability in Sonos Era 300 Speakers

CVE-2025-1050

What is CVE-2025-1050?

The Sonos Era 300 contains a vulnerability that permits network-adjacent attackers to execute arbitrary code on the device without requiring authentication. This security flaw arises from improper validation of user-supplied data during the processing of HLS playlist data, resulting in a potential write beyond the allocated memory space. An attacker could exploit this weakness to run malicious code under the context of the vulnerable user account.

References