This vulnerability originates from an out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES devices. The flaw stems from the lack of validation of Bluetooth L2CAP packet data and can allow an attacker to read memory beyond the intended buffer. The disclosed data could reveal sensitive information on the device. While the vulnerability alone does not provide direct execution capability, the description indicates that it could be leveraged alongside other weaknesses to achieve arbitrary code execution in the device’s context.

Sony XAV-9500ES media players are the affected hardware. No specific firmware or software version is listed, so all current devices bearing this product designation are assumed to be vulnerable until a patch is released.

The CVSS score of 3.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to physically bring a malicious Bluetooth device into pairing proximity with the target, meaning the attack vector is local and network‑adjacent. The need for pairing reduces the likelihood of widespread exploitation but does not eliminate the risk, especially if operators neglect to restrict Bluetooth usage.