The vulnerability resides in Sony XAV‑9500ES digital media players’ handling of process crash dumps. The firmware fails to validate a user‑supplied string before passing it to a system call, allowing a locally authenticated attacker that has already achieved low‑privilege code execution to inject arbitrary commands. Successful exploitation elevates the attacker’s privileges to root, granting full control over the device and enabling arbitrary code execution. This flaw is a classic command injection weakness (CWE‑78).

Sony XAV‑9500ES digital media players are impacted. The flaw exists in the crash‑dump handler of the device firmware; no specific firmware revisions are noted, so all current installations of the XAV‑9500ES model could be affected.

When the CVSS score is 7.8, the vulnerability is considered high severity. EPSS is not available, so current exploitation likelihood is unclear, and it is not listed in CISA KEV catalog. The attack requires a local, low‑privilege foothold; an attacker must first run code with limited privileges before triggering the command injection. Because the flaw permits escalation to root, the potential impact extends to full device control, including media playback tampering, firmware manipulation, and covert data exfiltration.