CVE-2025-5478 Overview
CVE-2025-5478 is an integer overflow vulnerability [CWE-190] in the Sony XAV-AX8500 in-vehicle receiver. The flaw resides in the device's Bluetooth Service Discovery Protocol (SDP) implementation. Network-adjacent attackers can exploit this issue without authentication or user interaction. Successful exploitation leads to arbitrary code execution in the context of root on the affected head unit. The vulnerability was disclosed through the Zero Day Initiative under tracking identifier ZDI-CAN-26288 and published as ZDI-25-355.
Critical Impact
An attacker within Bluetooth range can execute arbitrary code as root on the XAV-AX8500, gaining full control of the in-vehicle infotainment device without any user interaction.
Affected Products
- Sony XAV-AX8500 hardware unit
- Sony XAV-AX8500 firmware (versions prior to the vendor patch)
- Vehicles equipped with the XAV-AX8500 media receiver
Discovery Timeline
- 2025-06-21 - CVE-2025-5478 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5478
Vulnerability Analysis
The vulnerability exists in the Bluetooth SDP protocol handler of the XAV-AX8500 firmware. SDP is the discovery mechanism Bluetooth devices use to enumerate services offered by a peer. The XAV-AX8500 parses SDP requests received over Bluetooth without correctly validating length or size fields supplied by the remote peer.
During processing, an attacker-controlled value is used in an arithmetic operation that calculates a buffer allocation size. The calculation wraps around due to integer overflow, producing a value far smaller than the data that will subsequently be written. The undersized buffer is then populated with attacker-supplied content, corrupting adjacent memory.
Because the SDP service runs with root privileges on the head unit, successful memory corruption yields code execution at the highest privilege level. The CVSS attack vector indicates adjacent network exploitation, reflecting the Bluetooth radio range requirement.
Root Cause
The root cause is the absence of bounds checking on length fields parsed from incoming SDP protocol data units. The arithmetic operation that computes the allocation size lacks overflow detection, allowing a crafted length value to wrap past the maximum representable integer. This is a classic CWE-190 Integer Overflow that precedes a heap buffer overflow.
Attack Vector
An attacker must be within Bluetooth radio range of the target XAV-AX8500. No pairing, authentication, or user interaction is required. The attacker initiates an SDP transaction containing malformed length values that trigger the overflow. Once root-level code execution is achieved, the adversary can persist on the device, pivot to connected vehicle networks, or exfiltrate paired phone data.
No verified public exploit code is currently available. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-355.
Detection Methods for CVE-2025-5478
Indicators of Compromise
- Unexpected Bluetooth pairing attempts or SDP queries logged by the head unit when in range of unknown devices
- Anomalous outbound network connections initiated by the XAV-AX8500 if integrated with vehicle telematics
- Firmware version strings reported by the head unit that predate the vendor's 00344092 software update
Detection Strategies
- Capture Bluetooth traffic in proximity to the vehicle using an HCI sniffer and inspect SDP PDUs for oversized or malformed length descriptors
- Monitor for SDP service requests containing continuation state values that produce arithmetic anomalies during parsing
- Audit firmware versions across fleet vehicles to identify units running pre-patch builds
Monitoring Recommendations
- Enable Bluetooth activity logging where supported by the head unit and review for unsolicited SDP enumeration
- For fleet operators, integrate vehicle telematics logs into a SIEM and alert on unusual head unit network behavior
- Periodically verify the XAV-AX8500 firmware version against the latest release published on the Sony support portal
How to Mitigate CVE-2025-5478
Immediate Actions Required
- Apply the Sony firmware update referenced by support article 00344092 to all affected XAV-AX8500 units
- Until patched, disable Bluetooth on the head unit or set the device to non-discoverable mode
- Avoid parking the vehicle in high-density public areas where opportunistic Bluetooth attacks are more feasible
Patch Information
Sony has published a firmware update addressing the integer overflow in the SDP handler. The update is available through the official Sony Software Update page. Customers should follow the installation procedure documented by Sony, which typically involves transferring the firmware image to a USB drive and applying it through the head unit's update menu.
Workarounds
- Turn off the Bluetooth radio in the XAV-AX8500 settings when not actively using hands-free calling or audio streaming
- Unpair unknown or unused Bluetooth devices and limit pairing to trusted phones only
- Physically isolate the vehicle from untrusted environments until the firmware update is installed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
