Sony XAV-9500ES devices contain a buffer overflow in the gpsd daemon that processes NMEA satellite data. The flaw occurs because the length of user‑supplied data is not validated before being copied into a fixed‑size buffer. An attacker who can physically access the device can trigger the overflow, causing arbitrary code execution in the context of the gpsd process. This allows the attacker to run malicious code with the privileges granted to gpsd, potentially compromising the entire player.

The device affected is the Sony XAV‑9500ES digital media player. No specific firmware or patch versions are listed in the CNA data, so any current installations of the XAV‑9500ES may be susceptible. The vulnerability is tied to the gpsd daemon which is part of the device’s operating system and not a separate user‑installed application.

The CVSS base score of 3.9 places the overall severity in the low range, but the CVE description makes clear that exploitation results in local code execution without requiring authentication. The EPSS score is reported as unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating that no confirmed public exploits have been disclosed. Because the attack requires physically present access to the device, the likelihood of exploitation is limited by the need for direct, local presence. No remote attack vector is documented, so remote penetration is not possible for this issue.