ZDI-26-477: (Pwn2Own) Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18284.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-477?
The vulnerability ZDI-26-477 has a CVSS rating of 7.8, indicating it is of high severity.
How do I fix ZDI-26-477?
To mitigate ZDI-26-477, ensure that your Sony XAV-9500ES devices are updated to the latest firmware that addresses this vulnerability.
What type of attack does ZDI-26-477 facilitate?
ZDI-26-477 allows local privilege escalation on affected installations of Sony XAV-9500ES devices.
Who is affected by ZDI-26-477?
Users of Sony XAV-9500ES devices who are exposed to local attackers can be affected by ZDI-26-477.
What is required to exploit ZDI-26-477?
An attacker must first gain the ability to execute low-privileged code on the target Sony XAV-9500ES device to exploit ZDI-26-477.