# Sony vulnerabilities Source: https://junglewise.ai/threats/vendors/sony Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/sony.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Sony: 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116104, was published on 26 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 9 - All time: 14 (0 critical, 0 exploited in the wild) ## About Sony Sony is a multinational conglomerate that produces consumer electronics, gaming hardware, and semiconductors. ## Latest Sony vulnerabilities - [CVE-2026-116104: Sony Neural Network Libraries code injection in NNP Converter](https://junglewise.ai/threats/cve-2026-116104-a-security-flaw-has-been-discovered-in-sony-neural-network) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2026-116103: Sony Neural Network Libraries code injection in encode_param](https://junglewise.ai/threats/cve-2026-116103-a-vulnerability-was-identified-in-sony-neural-network-libraries) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2026-18284: Sony XAV-9500ES crash dump handler command injection](https://junglewise.ai/threats/cve-2026-18284-sony-xav-9500es-crash-dump-handler-command-injection) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18283: Sony XAV-9500ES udev USB Rules authorization bypass](https://junglewise.ai/threats/cve-2026-18283-sony-xav-9500es-udev-usb-rules-authorization-bypass) (low, CVSS 2.4, published 20 Aug 2026) - [CVE-2026-18282: Sony XAV-9500ES heap buffer overflow in AVRCP packet handling](https://junglewise.ai/threats/cve-2026-18282-sony-xav-9500es-heap-buffer-overflow-in-avrcp-packet-handling) (high, CVSS 8, published 20 Aug 2026) - [CVE-2026-18281: Sony XAV-9500ES heap buffer overflow in L2CAP packet handling](https://junglewise.ai/threats/cve-2026-18281-sony-xav-9500es-heap-buffer-overflow-in-l2cap-packet-handling) (high, CVSS 8, published 20 Aug 2026) - [CVE-2026-18280: Sony XAV-9500ES gpsd buffer overflow arbitrary code execution](https://junglewise.ai/threats/cve-2026-18280-sony-xav-9500es-gpsd-buffer-overflow-arbitrary-code-execution) (low, CVSS 3.9, published 20 Aug 2026) - [CVE-2026-18279: Sony XAV-9500ES RTSP buffer overflow remote code execution](https://junglewise.ai/threats/cve-2026-18279-sony-xav-9500es-rtsp-buffer-overflow-remote-code-execution) (high, CVSS 8.8, published 20 Aug 2026) - [CVE-2026-18278: Sony XAV-9500ES out-of-bounds read in Bluetooth L2CAP handler](https://junglewise.ai/threats/cve-2026-18278-sony-xav-9500es-out-of-bounds-read-in-bluetooth-l2cap-handler) (low, CVSS 3.5, published 20 Aug 2026) - [CVE-2026-59776: Sony FeliCa IC chips missing cryptographic step](https://junglewise.ai/threats/cve-2026-59776-sony-felica-ic-chips-missing-cryptographic-step) (medium, CVSS 6.8, published 21 Jul 2026) - [CVE-2026-50255: Sony Optical Disc Archive Software incorrect default permissions](https://junglewise.ai/threats/cve-2026-50255-sony-optical-disc-archive-software-incorrect-default-permissions) (medium, CVSS 6.7, published 16 Jun 2026) - [CVE-2025-64390: Sony PlayStation 4 privilege escalation in BD-J sandbox](https://junglewise.ai/threats/cve-2025-64390-sony-playstation-4-privilege-escalation-in-bd-j-sandbox) (info, CVSS 0, published 2 Jun 2026) - [CVE-2025-64730: Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary…](https://junglewise.ai/threats/cve-2025-64730-cross-site-scripting-vulnerability-exists-in-snc-cx600w-all) (medium, CVSS 6.1, published 25 Nov 2025) - [CVE-2025-62497: Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a…](https://junglewise.ai/threats/cve-2025-62497-cross-site-request-forgery-vulnerability-exists-in-snc-cx600w) (medium, CVSS 6.5, published 25 Nov 2025) ## Most severe Sony vulnerabilities - [CVE-2026-18279: Sony XAV-9500ES RTSP buffer overflow remote code execution](https://junglewise.ai/threats/cve-2026-18279-sony-xav-9500es-rtsp-buffer-overflow-remote-code-execution) (high, CVSS 8.8, published 20 Aug 2026) - [CVE-2026-18282: Sony XAV-9500ES heap buffer overflow in AVRCP packet handling](https://junglewise.ai/threats/cve-2026-18282-sony-xav-9500es-heap-buffer-overflow-in-avrcp-packet-handling) (high, CVSS 8, published 20 Aug 2026) - [CVE-2026-18281: Sony XAV-9500ES heap buffer overflow in L2CAP packet handling](https://junglewise.ai/threats/cve-2026-18281-sony-xav-9500es-heap-buffer-overflow-in-l2cap-packet-handling) (high, CVSS 8, published 20 Aug 2026) - [CVE-2026-18284: Sony XAV-9500ES crash dump handler command injection](https://junglewise.ai/threats/cve-2026-18284-sony-xav-9500es-crash-dump-handler-command-injection) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-59776: Sony FeliCa IC chips missing cryptographic step](https://junglewise.ai/threats/cve-2026-59776-sony-felica-ic-chips-missing-cryptographic-step) (medium, CVSS 6.8, published 21 Jul 2026) - [CVE-2026-50255: Sony Optical Disc Archive Software incorrect default permissions](https://junglewise.ai/threats/cve-2026-50255-sony-optical-disc-archive-software-incorrect-default-permissions) (medium, CVSS 6.7, published 16 Jun 2026) - [CVE-2025-62497: Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a…](https://junglewise.ai/threats/cve-2025-62497-cross-site-request-forgery-vulnerability-exists-in-snc-cx600w) (medium, CVSS 6.5, published 25 Nov 2025) - [CVE-2026-116104: Sony Neural Network Libraries code injection in NNP Converter](https://junglewise.ai/threats/cve-2026-116104-a-security-flaw-has-been-discovered-in-sony-neural-network) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2026-116103: Sony Neural Network Libraries code injection in encode_param](https://junglewise.ai/threats/cve-2026-116103-a-vulnerability-was-identified-in-sony-neural-network-libraries) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2025-64730: Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary…](https://junglewise.ai/threats/cve-2025-64730-cross-site-scripting-vulnerability-exists-in-snc-cx600w-all) (medium, CVSS 6.1, published 25 Nov 2025) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 7 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sony technologies - [Sony XAV-9500ES](https://junglewise.ai/threats/technologies/xav-9500es): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Sony vulnerabilities", https://junglewise.ai/threats/vendors/sony, 9 November 2026.