Heap-based Buffer Overflow Vulnerability in Sony XAV-9500ES Bluetooth Device
CVE-2026-18281

8HIGH

Key Information:

Vendor

Sony

Status
Xav-9500es
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18281?

The vulnerability in the Sony XAV-9500ES device stems from an improper handling of Bluetooth L2CAP packets, which fails to sufficiently validate the length of user-supplied data before copying it to a heap-based buffer. This oversight can potentially allow network-adjacent attackers, who can pair a malicious Bluetooth device with the target system, to execute arbitrary code on the device. This vulnerability emphasizes the importance of rigorous input validation in Bluetooth communications to safeguard devices from unauthorized access and execution of harmful code.

Affected Version(s)

XAV-9500ES 3.02.00

References

https://www.zerodayinitiative.com/advisories/ZDI-26-474/
x_research-advisory
https://www.sony.com/electronics/support/mobile-cd-player...
vendor-advisory

CVSS V3.0

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.