CVE-2026-18280 Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exist...

CVE-2026-18280

CVE-2026-18280 is a buffer overflow in the gpsd daemon of the Sony XAV-9500ES car audio device, specifically in the handling of NMEA data . The root cause is the lack of proper validation of user-supplied data length before copying it to a fixed-length buffer. A physically present attacker can ex...