ZDI-CAN-29060: ZDI-26-473: (Pwn2Own) Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability

Published Jul 29, 2026

Updated

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.9. The following CVEs are assigned: CVE-2026-18280.

Affected Software

1 affected component

Sony XAV-9500ES

Event History

Jul 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-29060?

The severity of ZDI-CAN-29060 is rated at 3.9 according to the CVSS system.

How do I fix ZDI-CAN-29060?

To fix ZDI-CAN-29060, ensure that you update the firmware of your Sony XAV-9500ES device to the latest version provided by the manufacturer.

What types of attacks can exploit ZDI-CAN-29060?

ZDI-CAN-29060 can be exploited by physically present attackers to execute arbitrary code on the affected Sony XAV-9500ES devices.

Is authentication required to exploit ZDI-CAN-29060?

No, authentication is not required to exploit ZDI-CAN-29060, making it particularly dangerous.

Which devices are affected by ZDI-CAN-29060?

The vulnerability ZDI-CAN-29060 affects the Sony XAV-9500ES media receiver.