CVE-2026-18281: (Pwn2Own) Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability
Sony XAV-9500ES l2reassemblesdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29072.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Affected Sony XAV-9500ES installations are exposed to network-adjacent attackers operating over Bluetooth. Exploitation requires the attacker to pair a malicious Bluetooth device with the target system.
What access and interaction does an attacker need?
The attacker does not need prior privileges, but must obtain the ability to pair their malicious Bluetooth device with the target. User interaction is required according to the supplied severity vector.
What is the potential impact after successful exploitation?
A successful attacker can execute arbitrary code in the context of the device. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.