CVE-2026-18280

Name of the Vulnerable Software and Affected Versions Sony XAV-9500ES (affected versions not specified)

Description Physically present attackers can execute arbitrary code on affected devices without requiring authentication. The issue occurs within the gpsd daemon during the handling of NMEA data, which is a standard data format used by GPS receivers. The flaw is caused by a lack of proper length validation of user-supplied data before it is copied into a fixed-length buffer, leading to a buffer overflow. This can be used to execute code within the context of the gpsd daemon.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.