CVE-2026-18279: (Pwn2Own) Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability
Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of SETUP RTSP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29042.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Affected Sony XAV-9500ES devices reachable by a network-adjacent attacker are exposed. Exploitation does not require authentication or user interaction.
What must an attacker send to trigger the issue?
An attacker must send a crafted RTSP SETUP packet containing oversized user-supplied data. The vulnerable handling copies this data into a fixed-length buffer without properly validating its length.
What level of access could successful exploitation provide?
Successful exploitation allows arbitrary code execution in the context of the affected device. The vulnerability is rated high severity with impacts to confidentiality, integrity, and availability.