Buffer Overflow Vulnerability in Sony XAV-9500ES Devices
CVE-2026-18280

3.9LOW

Key Information:

Vendor

Sony

Status
Xav-9500es
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18280?

A vulnerability in Sony XAV-9500ES devices arises from the improper handling of NMEA data by the gpsd daemon, allowing attackers with physical access to execute arbitrary code. The flaw is due to inadequate validation of user-supplied data length before it is copied to a fixed-length buffer. This oversight can be exploited in conjunction with additional vulnerabilities, enabling unauthorized code execution within the context of the gpsd daemon.

Affected Version(s)

XAV-9500ES 3.02.00

References

https://www.zerodayinitiative.com/advisories/ZDI-26-473/
x_research-advisory
https://www.sony.com/electronics/support/mobile-cd-player...
vendor-advisory

CVSS V3.0

Score:
3.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.