Sony’s 3.04.00 firmware for the XAV-9500ES in-dash receiver closes seven security holes that researchers first demonstrated at Pwn2Own Automotive 2026 in Tokyo. The ZDI advisories landed on July 29, thirteen days after the patch shipped, and the affected radios are still in vehicles worldwide.
The bugs span four attack routes. Two sit in Bluetooth – an L2CAP out-of-bounds read rated 3.5 and a heap-based overflow rated 8.0 – plus a Bluetooth AVRCP overflow also at 8.0. The most severe is a Real-Time Streaming Protocol buffer overflow at 8.8, reachable by anyone on the same network. The rest need a hand on the hardware: a USB-rules authorization bypass, a gpsd NMEA overflow, and a command injection in the crash-dump handler.
The flaws are tracked as CVE-2026-18278 through CVE-2026-18284. VicOne notes that pairing them matters more than counting them. A weak flaw can unlock a stronger one, moving an attacker from an adjacent network to code running on the head unit.
Owners should check for version 3.04.00. Units still on older builds carry all seven, and the Bluetooth paths need no physical access – only proximity.
