ZDI-CAN-28995: ZDI-26-475: (Pwn2Own) Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Jul 29, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-18282.

Affected Software

1 affected component

Sony XAV-9500ES

Event History

Jul 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28995?

The severity of ZDI-CAN-28995 is rated at 69.

How do I fix ZDI-CAN-28995?

To fix ZDI-CAN-28995, ensure that your Sony XAV-9500ES device is updated with the latest security patches provided by the manufacturer.

What devices are affected by ZDI-CAN-28995?

ZDI-CAN-28995 specifically affects Sony XAV-9500ES devices.

What type of vulnerability is ZDI-CAN-28995?

ZDI-CAN-28995 is a heap-based buffer overflow remote code execution vulnerability.

Can an attacker exploit ZDI-CAN-28995 remotely?

Yes, an attacker can exploit ZDI-CAN-28995 remotely after successfully pairing a malicious Bluetooth device with the target system.