CVE-2026-18279

Name of the Vulnerable Software and Affected Versions Sony XAV-9500ES (affected versions not specified)

Description Network-adjacent attackers can execute arbitrary code on affected devices without authentication. The issue occurs during the handling of SETUP RTSP packets, where the device fails to properly validate the length of user-supplied data before copying it into a fixed-length buffer, leading to a buffer overflow. This allows the attacker to execute code within the context of the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.