Bluetooth AVCTP Protocol Heap-based Buffer Overflow Vulnerability in Sony AV System
CVE-2025-5479

7.5HIGH

Key Information:

Vendor

Sony

Status
Xav-ax8500
Vendor
CVE Published:
21 June 2025

What is CVE-2025-5479?

The vulnerability found in Sony XAV-AX8500 devices relates to a flaw in the Bluetooth AVCTP protocol implementation, which allows attackers to execute arbitrary code. This arises from inadequate validation of user-supplied data length when copying to a heap-based buffer. Compromised Bluetooth devices can leverage this weakness for remote code execution, posing significant risks to device integrity and user data security.

Affected Version(s)

XAV-AX8500 2.00.01

References

https://www.zerodayinitiative.com/advisories/ZDI-25-356/
x_research-advisory
https://www.sony.com/electronics/support/mobile-cd-player...
vendor-advisory

CVSS V3.0

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.