The flaw is a heap-based buffer overflow triggered when a Bluetooth L2CAP packet is processed. The device fails to validate the length of user-supplied data before copying it into a heap buffer, enabling an attacker who has paired a malicious Bluetooth device to execute arbitrary code on the Sony XAV-9500ES. This represents a Remote Code Execution weakness (CWE-122).

Sony XAV-9500ES digital media players are affected. No specific firmware version details are publicly supplied; the identified model supports Bluetooth L2CAP and is therefore potentially vulnerable.

The CVSS score of 8.0 indicates high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood is uncertain. However, the attack requires a Bluetooth pairing interaction, limiting the window of opportunity to a nearby attacker. Once pairing is achieved, arbitrary code execution can be realized, posing a significant risk to device integrity and confidentiality.