ZDI-CAN-28990: ZDI-26-471: (Pwn2Own) Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability

Published Jul 29, 2026

Updated

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.5. The following CVEs are assigned: CVE-2026-18278.

Affected Software

1 affected component

Sony XAV-9500ES

Event History

Jul 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28990?

The severity of ZDI-CAN-28990 is rated at 15.

How do I fix ZDI-CAN-28990?

To fix ZDI-CAN-28990, ensure that the Sony XAV-9500ES device is updated to the latest firmware provided by the manufacturer.

What types of attacks are possible due to ZDI-CAN-28990?

ZDI-CAN-28990 allows network-adjacent attackers to perform information disclosure attacks.

What devices are affected by ZDI-CAN-28990?

ZDI-CAN-28990 specifically affects the Sony XAV-9500ES devices.

What is required for an attacker to exploit ZDI-CAN-28990?

An attacker must first obtain the ability to pair a malicious Bluetooth device with the Sony XAV-9500ES to exploit ZDI-CAN-28990.