CVE-2026-18279 Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

CVE-2026-18278

The Sony XAV-9500ES infotainment system's prh_l2_decode_packet function lacks proper validation of Bluetooth L2CAP packet data, causing an out-of-bounds buffer read. Attackers must first pair a malicious Bluetooth device, then can disclose sensitive information; chaining with other flaws may enab...

CVE-2026-18278 Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability

Sony XAV-9500ES prhl2decodepacket Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

EUVD-2026-63425

Sony XAV-9500ES prhl2decodepacket Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

JLSEC-2026-1107

In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF" function libraw\src\metadata\sony.cpp when processing srf files...

PT-2026-65942

Sony XAV-9500ES prh l2 decode packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

PT-2026-65943

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

PT-2026-65948

Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to execute low-privileged code on the...

PT-2026-65946

Sony XAV-9500ES AVRCP Br Response Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicio...

PT-2026-65945

Sony XAV-9500ES l2 reassemble sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

PT-2026-65947

Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

PT-2026-65944

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exist...

USN-8586-1: libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...

USN-8586-1 libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...

OESA-2026-2067 libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fixes: libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptpunpackCanonFE function in...

OESA-2026-2069 libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fixes: libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptpunpackCanonFE function in...

OESA-2026-2071 libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fixes: libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptpunpackCanonFE function in...

OESA-2026-2070 libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fixes: libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptpunpackCanonFE function in...

OESA-2026-2068 libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fixes: libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptpunpackCanonFE function in...

SUSE CVE-2026-40336

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptpunpackSonyDPD in camlibs/ptp2/ptp-pack.c lines 884-885. When processing a secondary enumeration list introduced in 2024+ Sony cameras, the function overwrites dpd-FORM.Enum.SupportedVal...