On July 29, 2026, TrendAI published advisory ZDI-26-475, which documents a remote code execution vulnerability in the Sony XAV-9500ES infotainment system. The flaw, discovered through the Pwn2Own program, exploits the AVRCP_Br_Response_Parser via a heap-based buffer overflow triggered after pairing a malicious Bluetooth device. Sony had already released firmware 3.04.00 on July 16, 2026, but the update procedure requires operational conditions that many aftermarket users may not have readily available.
- Advisory ZDI-26-475 confirms RCE on the Sony XAV-9500ES via a heap-based buffer overflow in the AVRCP_Br_Response_Parser component, with a network-adjacent attack after malicious Bluetooth pairing.
- Coordinated disclosure began March 19, 2026; public disclosure occurred July 29, 2026.
- Sony released firmware 3.04.00 on July 16, 2026, fixing vulnerabilities in the Bluetooth communication function.
- The dossier does not specify an assigned CVE-ID or CVSS score, and does not document whether a public exploit exists outside the Pwn2Own competitive context.
The Mechanism: What Breaks the AVRCP Parser
The defect lies in the handling of AVRCP (Audio/Video Remote Control Profile) packets, the Bluetooth profile that enables remote control of media playback. In the Sony XAV-9500ES firmware, the AVRCP_Br_Response_Parser component fails to validate the length of user-supplied data before copying it to a heap-allocated buffer.
"The specific flaw exists within the handling of AVRCP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer." — TrendAI Zero Day Initiative (ZDI-26-475)
This missing validation allows controlled overwrite of heap memory and, consequently, arbitrary code execution in the context of the infotainment device. The ZDI advisory notes that an attacker must first gain the ability to pair a malicious Bluetooth device with the target system. This preliminary pairing requirement defines the attack perimeter: this is not an exploit remotely exploitable over the internet, but a network-adjacent vector that typically translates to the range of a Bluetooth connection.
The Attack Chain: From Parking Lot to Compromise
The attack surface is concrete for this product category. The XAV-9500ES is an aftermarket head unit that replaces a vehicle's factory stereo, popular among car audio enthusiasts seeking smartphone integration and streaming services. Bluetooth often remains active after the engine is turned off to allow automatic reconnection on the next startup.
An attacker in physical proximity to the vehicle — within the operational range of the Bluetooth profile, which the dossier does not specifically quantify but which in the classic standard stands at approximately ten meters — could have a window of action in public parking areas, residential garages, or service stations. The preliminary pairing acts as a filter, but not an insurmountable barrier: previously paired devices, socially engineered pairing procedures, or pairing states stored in firmware could offer maneuvering room that the advisory does not detail.
What the ZDI dossier documents with certainty is the ability to execute arbitrary code once the pairing condition is established. The technical reading suggests the execution context — the infotainment device process — has access to the system's communication functions, but the source does not specify the exact nature of the exposed data or interfaces.
Sony's Response: Firmware 3.04.00 and Its Procedures
Sony released firmware update 3.04.00 on July 16, 2026, roughly two weeks before the coordinated ZDI disclosure. The official support page lists among the fixes the remediation of "security vulnerabilities in the Bluetooth communication function, Wi-Fi communication function, and USB function." The same page acknowledges TrendAI ZDI researchers among the reporters of the addressed vulnerabilities.
The installation procedure documented by Sony requires USB tethering with a mobile device or the use of a FAT32-formatted USB flash drive, starting the vehicle's engine to ensure stable power, and an estimated 15–30 minutes for completion. These operational requirements — particularly the need to start the engine and the risk of amplifier damage if the process is interrupted — create real friction for patch adoption by end users. The dossier does not document over-the-air distribution or automatic update mechanisms.
Why It Matters
The dossier does not specify whether a reproducible public exploit exists outside the Pwn2Own lab, nor does it document in-the-wild attacks. These limits make the immediate risk to the average user uncertain, but do not diminish the structural relevance of the vulnerability.
The source does not identify specific vulnerable firmware versions beyond the generic pre-3.04.00 condition, and does not quantify the exposed device population. The assigned CVE-ID, if any, is not reported in the extracted text of the ZDI advisory, and the CVSS score is not documented. The identity of the researcher or team who discovered the flaw remains credited generically through the ZDI program, without a public name.
The brief does not document specific mitigations beyond the firmware update. No indications emerge regarding temporary Bluetooth disablement, monitoring for pairing anomalies, or verification of installed firmware integrity. The source also does not specify whether the vulnerability affects product variants or related series in Sony's lineup.
The Signal for the Automotive Industry
ZDI-26-475 fits into an established line of research demonstrating the concreteness of Bluetooth attack surfaces in IVI (In-Vehicle Infotainment) systems as targets for RCE exploits in competitive contexts. The Pwn2Own program, in its specific automotive track, has progressively extended its scope from onboard components to peripheral connectivity subsystems such as AVRCP.
The substantial difference compared to vulnerabilities in more deeply integrated vehicle components — CAN bus, ECUs, OEM telematics — lies in the democratization of the attack surface. An aftermarket head unit is installable on thousands of vehicle models, multiplying the exposed population by an order of magnitude compared to a flaw tied to a specific OEM platform. The corrective firmware, moreover, depends on end-user initiative in the absence of centralized management mechanisms typical of corporate fleet management or OEM connected systems.
For the infotainment component sector, the advisory serves as a case study on the tension between open Bluetooth pairing — a core selling feature for aftermarket products — and validation of protocol parsers that handle untrusted data. The AVRCP_Br_Response_Parser is not an exotic proprietary component, but an implementation of a standard Bluetooth profile: its compromise suggests software engineering defects that could recur in other contexts adopting the same stack.
Information is based on the cited advisory and current as of publication.
Sources
- http://www.zerodayinitiative.com/advisories/ZDI-26-475/
- http://www.zerodayinitiative.com/advisories/published/
- https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922
Information is based on the cited source and current as of publication.