ZDI-CAN-28990: ZDI-26-471: (Pwn2Own) Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth L2CAP packets. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.
Other sources
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.5. The following CVEs are assigned: CVE-2026-18278.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sony XAV-9500ESto a version that resolves this vulnerability.Patch ZDI-26-471 - Compensating control
Prevent exploitation by blocking pairing of untrusted Bluetooth devices with the Sony XAV-9500ES (only allow pairing with trusted devices).
- Compensating control
Limit network adjacency to the affected device by restricting access to the Sony XAV-9500ES from untrusted networks/devices where practical.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28990?
The severity of ZDI-CAN-28990 is rated at 15.
How do I fix ZDI-CAN-28990?
To fix ZDI-CAN-28990, ensure that the Sony XAV-9500ES device is updated to the latest firmware provided by the manufacturer.
What types of attacks are possible due to ZDI-CAN-28990?
ZDI-CAN-28990 allows network-adjacent attackers to perform information disclosure attacks.
What devices are affected by ZDI-CAN-28990?
ZDI-CAN-28990 specifically affects the Sony XAV-9500ES devices.
What is required for an attacker to exploit ZDI-CAN-28990?
An attacker must first obtain the ability to pair a malicious Bluetooth device with the Sony XAV-9500ES to exploit ZDI-CAN-28990.