Quick answers
- Is CVE-2026-18281 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18281 being exploited in the wild.
- How severe is CVE-2026-18281?
- High severity, with a CVSS score of 8, published 20 August 2026.
- Which products and versions are affected?
- Sony XAV-9500ES.
- Is there a fix for CVE-2026-18281?
- A patch was published on 2026-07-29: Coordinated public release and patch availability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18281 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-18281?
- Check whether you run Sony XAV-9500ES. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a heap-based buffer overflow (CWE-122) in the l2_reassemble_sdu function that processes Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) packets. The root cause is insufficient validation of user-supplied packet length before copying data to a heap buffer. The attack requires network-adjacent access (Bluetooth pairing capability) and user interaction (accepting the malicious device pairing). An authenticated attacker can send specially crafted L2CAP packets to trigger the overflow and execute arbitrary code with device privileges. Sony has released an update to address this vulnerability.
Affected products
- Sony XAV-9500ES
Timeline
- 2026-03-19: disclosed: Vulnerability reported to vendor
- 2026-07-29: patched: Coordinated public release and patch availability
- 2026-07-29: advisory: ZDI-26-474 advisory published