CVE-2026-18281

Sony XAV-9500ES l2reassemblesdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

EUVD-2026-63428

Sony XAV-9500ES l2reassemblesdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

CVE-2026-18281

CVE-2026-18281 is a heap-based buffer overflow in the Sony XAV-9500ES car audio/video receiver, specifically in the l2_reassemble_sdu function that handles Bluetooth L2CAP packets . The root cause is the lack of proper length validation on user-supplied data before copying it into a heap-based bu...