CVE-2026-18280: (Pwn2Own) Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability
Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of NMEA data by the gpsd daemon. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the gpsd daemon. Was ZDI-CAN-29060.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Physically restrict access to Sony XAV-9500ES devices to prevent physically present attackers from exploiting the gpsd NMEA buffer overflow (ZDI-CAN-29060).
- Compensating control
Mitigate exploitation of gpsd by isolating or restricting network access to the gpsd service on affected Sony XAV-9500ES devices (authentication is not required), per your network segmentation/ACL/WAF controls (ZDI-CAN-29060).