# CVE-2026-18281: Sony XAV-9500ES heap buffer overflow in L2CAP packet handling

Source: https://junglewise.ai/threats/cve-2026-18281-sony-xav-9500es-heap-buffer-overflow-in-l2cap-packet-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18281 · Severity: high · CVSS 8 · Published 2026-08-20

The Sony XAV-9500ES is a mobile digital media receiver used in vehicles for audio and multimedia control. A heap-based buffer overflow in Bluetooth L2CAP packet processing allows an attacker who pairs a malicious Bluetooth device to execute arbitrary code and take full control of the receiver, potentially compromising user privacy and vehicle safety features.

Technologies: [Sony XAV-9500ES](https://junglewise.ai/threats/technologies/xav-9500es). Vendors: [Sony](https://junglewise.ai/threats/vendors/sony).

## Quick answers

**Is CVE-2026-18281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18281 being exploited in the wild.

**How severe is CVE-2026-18281?** High severity, with a CVSS score of 8, published 20 August 2026.

**Which products and versions are affected?** Sony XAV-9500ES.

**Is there a fix for CVE-2026-18281?** A patch was published on 2026-07-29: Coordinated public release and patch availability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18281 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-18281?** Check whether you run Sony XAV-9500ES. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a heap-based buffer overflow (CWE-122) in the l2_reassemble_sdu function that processes Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) packets. The root cause is insufficient validation of user-supplied packet length before copying data to a heap buffer. The attack requires network-adjacent access (Bluetooth pairing capability) and user interaction (accepting the malicious device pairing). An authenticated attacker can send specially crafted L2CAP packets to trigger the overflow and execute arbitrary code with device privileges. Sony has released an update to address this vulnerability.

## Affected products

- Sony XAV-9500ES

## Timeline

- 2026-03-19: disclosed: Vulnerability reported to vendor
- 2026-07-29: patched: Coordinated public release and patch availability
- 2026-07-29: advisory: ZDI-26-474 advisory published

## References

- [https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922](https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-474/](https://www.zerodayinitiative.com/advisories/ZDI-26-474/)

## Related threats

- [Sony XAV-9500ES crash dump handler command injection](https://junglewise.ai/threats/cve-2026-18284-sony-xav-9500es-crash-dump-handler-command-injection)
- [Sony XAV-9500ES udev USB Rules authorization bypass](https://junglewise.ai/threats/cve-2026-18283-sony-xav-9500es-udev-usb-rules-authorization-bypass)
- [Sony XAV-9500ES heap buffer overflow in AVRCP packet handling](https://junglewise.ai/threats/cve-2026-18282-sony-xav-9500es-heap-buffer-overflow-in-avrcp-packet-handling)
- [Sony XAV-9500ES gpsd buffer overflow arbitrary code execution](https://junglewise.ai/threats/cve-2026-18280-sony-xav-9500es-gpsd-buffer-overflow-arbitrary-code-execution)
- [Sony XAV-9500ES RTSP buffer overflow remote code execution](https://junglewise.ai/threats/cve-2026-18279-sony-xav-9500es-rtsp-buffer-overflow-remote-code-execution)