On July 29, 2026, TrendAI Zero Day Initiative published advisory ZDI-26-475, a vulnerability in the Sony XAV-9500ES infotainment system that enables remote code execution via Bluetooth. The flaw, discovered in a Pwn2Own context, required four months of coordination between researchers and the vendor to produce a corrective firmware that the end user must install manually using workshop procedures.
- Advisory ZDI-26-475 (CVE-2026-18282, CVSS 8.0) documents a heap-based buffer overflow in the Sony XAV-9500ES AVRCP_Br_Response parser
- The attacker must successfully pair a malicious Bluetooth device with the target system to exploit the vulnerability
- Sony released firmware 3.04.00 on July 16, 2026, which fixes Bluetooth, Wi-Fi, and USB vulnerabilities
- The disclosure timeline spanned over four months: initial report on March 19, 2026, coordinated publication on July 29, 2026
The AVRCP Parser Flaw: When the Audio-Video Profile Becomes an Attack Vector
The technical core lies in the AVRCP (Audio/Video Remote Control Profile) packet handler, the Bluetooth profile that enables remote control of media playback. In the Sony XAV-9500ES, the AVRCP_Br_Response parser does not validate the length of user-supplied data before copying it into a dynamically allocated heap buffer. This missing validation generates a directly exploitable heap-based buffer overflow for remote code execution.
The attack condition is narrow but non-trivial: the attacker must be within Bluetooth range and have completed successful pairing of their device with the infotainment system. Once this threshold is crossed, compromise occurs in the context of the process handling the AVRCP profile, with the potential to take control of the system.
"This vulnerability allows network-adjacent attackers to execute arbitrary code on vulnerable installations of Sony XAV-9500ES. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system to exploit this vulnerability." — Advisory ZDI-26-475, TrendAI Zero Day Initiative
From Pwn2Own to Sony Release: Four Months of Responsible Coordination
The Pwn2Own origin of the vulnerability emerges from the explicit tag in the ZDI-CAN-28995 entry, published in the TrendAI advisory list. The competition, organized by Zero Day Initiative, provides a controlled scenario for demonstrating exploits against selected targets: participation with a Sony infotainment system indicates the research overcame the system's defenses in realistic conditions, not just theoretical ones.
The coordination timeline was extended. The initial report is dated March 19, 2026. Sony released the corrective firmware 3.04.00 on July 16, 2026. The ZDI advisory was published on July 29, 2026, over four months after the report. This interval reflects the complexity of the update cycle in the automotive sector, where firmware cannot be distributed with the same frequency as a traditional software Patch Tuesday.
The Sony advisory explicitly acknowledges the researchers who collaborated with TrendAI Zero Day Initiative, although it does not associate specific names with the individual Bluetooth vulnerability. The Sony documentation lists multiple groups without detailed mapping of which team discovered which flaw.
The Manual Fix Problem: Why the Update Is Not Automatic
The installation procedure for firmware 3.04.00 documented by Sony requires active intervention by the owner with non-trivial operations. The update file must be loaded onto a USB storage device or used via smartphone tethering, with the vehicle in specific ignition conditions. The Sony documentation includes warnings about the risk of damage to audio amplifiers if the procedure is interrupted or executed with incorrect parameters.
This friction between patch availability and actual application represents a recurring pattern in the automotive ecosystem. Unlike over-the-air updates common in premium electric vehicles, aftermarket infotainment systems or OEM units from some manufacturers maintain traditional distribution channels that leave vulnerable systems operational for indefinite periods.
The dossier does not specify whether other models in the XAV family share the same AVRCP parser code. Sony fixed Bluetooth, Wi-Fi, and USB vulnerabilities in the same firmware release: the exact scope of the update beyond the XAV-9500ES model is not documented in the available sources.
What to Do Now
- Verify the firmware version installed on your Sony XAV-9500ES and update to release 3.04.00 if lower
- Follow the Sony update procedure via USB or smartphone tethering with the vehicle powered on according to the technical manual specifications
- Remove unrecognized or no-longer-used paired profiles from the device's Bluetooth memory
- Contact Sony support to confirm compatibility of your unit with firmware 3.04.00 before proceeding with installation
Infotainment as an Attack Surface: Beyond the Single Device
The ZDI-26-475 vulnerability sits in a broader trend of research on vehicle embedded systems. The Bluetooth AVRCP profile is designed for remote control functionality: its implementation in the context of an infotainment system with access to the vehicle bus amplifies the relevance of a memory overflow that in other contexts would remain confined to the multimedia domain.
The discovery in a Pwn2Own context confirms that attackers with dedicated resources can compromise vehicles physically through standardized proximity vectors. The CVSS 8.0 assigned to CVE-2026-18282 reflects the completeness of the impact on the three pillars of the CIA triad — confidentiality, integrity, availability — while maintaining attack complexity tied to the pairing condition.
It remains undocumented whether the Pwn2Own demonstration included escalation to other vehicle systems beyond the context of the compromised AVRCP process. The ZDI advisory does not detail the full exploit chain: it describes the entry point and conditions, but not post-exploitation.
Frequently Asked Questions
Is it necessary to be inside the vehicle to exploit the vulnerability?
The ZDI advisory qualifies the attacker as "network-adjacent," which in the Bluetooth case implies physical proximity within the radio signal coverage range. The dossier does not specify whether range-extension techniques or attack relay were demonstrated.
Does firmware 3.04.00 fix only this vulnerability?
No. According to the Sony advisory, firmware 3.04.00 released on July 16, 2026 fixes vulnerabilities in the Bluetooth communication function, the Wi-Fi communication function, and the USB function. The source does not specify whether these are technically correlated or independent.
Is it confirmed that CVE-2026-18282 corresponds exactly to ZDI-26-475?
The correspondence is not explicitly stated in the ZDI advisory, which does not report a CVE in the main body. The published ZDI list (Source 2) associates internal ID ZDI-CAN-28995 with CVE-2026-18282 with the same technical characteristics of the model and parser. The dossier records this convergence without official confirmation of absolute identity between the identifiers.
Sources
- http://www.zerodayinitiative.com/advisories/ZDI-26-475/
- http://www.zerodayinitiative.com/advisories/published/
- https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922
Information has been verified against cited sources and updated at time of publication.