CVE-2026-18281— Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Sony | XAV-9500ES | 3.02.00 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29072.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Sony | XAV-9500ES | 3.02.00 | - |
II. Public POCs for CVE-2026-18281
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18281
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18281 (1)
- 🔗 ZDI-26-474 - TrendAI™ Zero Day Initiative™ (ZDI)x_research-advisory
Vendor Pages for CVE-2026-18281 (1)
Same Patch Batch · Sony · 2026-08-20 · 7 CVEs total
| CVE-2026-18283 | Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability | |
| CVE-2026-18280 | Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability | |
| CVE-2026-18279 | Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability | |
| CVE-2026-18282 | Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution | |
| CVE-2026-18278 | Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerabili | |
| CVE-2026-18284 | Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerabil |
IV. Related Vulnerabilities
Same product: XAV-9500ES
- CVE-2026-18284
Sony XAV-9500ES Crash Dump Handler Command Injection Local P - CVE-2026-18283
Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerab - CVE-2026-18282
Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer O - CVE-2026-18280
Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Executio - CVE-2026-18279
Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execu
Same vendor: Sony
- CVE-2026-18284
Sony XAV-9500ES Crash Dump Handler Command Injection Local P - CVE-2026-18283
Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerab - CVE-2026-18282
Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer O - CVE-2026-18280
Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Executio - CVE-2026-18279
Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execu
Same weakness: CWE-122
- CVE-2026-62381
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overf - CVE-2026-50538
libvncclient Tight decoder has an attacker-controlled heap o - CVE-2026-55893
Capstone SH disassembler `set_reg_n` heap buffer overflow vi - CVE-2026-70654
libvips: A well-crafted PPM image processed via a custom sou - CVE-2026-70653
libvips: Possible heap-based buffer read overflow when decod
V. Comments for CVE-2026-18281
No comments yet