Sony XAV-9500ES Vulnerability Allows Information Disclosure via Bluetooth
A vulnerability in Sony's XAV-9500ES infotainment system allows network-adjacent attackers to disclose sensitive information after pairing a malicious Bluetooth device.
A newly disclosed vulnerability, identified as ZDI-26-471 and assigned CVE-2026-18278, affects Sony's XAV-9500ES infotainment system, potentially exposing sensitive information to attackers.
The vulnerability resides within the device's handling of Bluetooth L2CAP packets. Specifically, the flaw stems from inadequate validation of user-supplied data, leading to an out-of-bounds read condition. This means the system attempts to read data beyond the boundaries of its allocated memory buffer.
Exploitation of this vulnerability requires a specific prerequisite: an attacker must first gain the ability to pair a malicious Bluetooth device with the targeted Sony XAV-9500ES system. Once this pairing is established, the attacker can then trigger the out-of-bounds read, which can lead to the disclosure of sensitive information.
While the vulnerability itself is rated with a CVSS score of 3.5, indicating a low severity for information disclosure, the advisory notes that this flaw can be leveraged in conjunction with other vulnerabilities. Successful exploitation of this chain could potentially allow an attacker to achieve arbitrary code execution within the context of the device.
The vulnerability was discovered by researchers @ExLuck99 and @gr4ss341 of ANHTUD. The Zero Day Initiative (ZDI) coordinated the disclosure, reporting the vulnerability to Sony on March 19, 2026. The public advisory was released on July 29, 2026, with an update to the advisory on the same day.
Sony has addressed this vulnerability by issuing a software update for the XAV-9500ES. Users are advised to visit the official Sony support website for their specific model to download and install the latest firmware to mitigate the risk.
This disclosure highlights the ongoing security challenges associated with connected automotive systems, particularly those with complex communication protocols like Bluetooth. The need for robust input validation and secure handling of network-adjacent communication remains paramount in preventing information disclosure and potential further compromise.