CVE-2026-18280: (Pwn2Own) Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability
Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of NMEA data by the gpsd daemon. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the gpsd daemon. Was ZDI-CAN-29060.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Physically restrict access to Sony XAV-9500ES devices to prevent physically present attackers from exploiting the gpsd NMEA buffer overflow (ZDI-CAN-29060).
- Compensating control
Mitigate exploitation of gpsd by isolating or restricting network access to the gpsd service on affected Sony XAV-9500ES devices (authentication is not required), per your network segmentation/ACL/WAF controls (ZDI-CAN-29060).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be physically present at an affected Sony XAV-9500ES device. No authentication is required.
What input is used to trigger the flaw?
The flaw is in gpsd's handling of NMEA data. Oversized user-supplied NMEA data can be copied into a fixed-length buffer without proper length validation.
Does exploitation provide code execution on its own?
The vulnerability can be leveraged with other vulnerabilities to execute code in the context of the gpsd daemon. The supplied information does not state that it independently results in code execution.