CVE-2025-5479: Sony XAV-AX8500 Firmware RCE Vulnerability

CVE-2025-5479 Overview

CVE-2025-5479 is a heap-based buffer overflow vulnerability in the Sony XAV-AX8500 in-vehicle receiver. The flaw resides in the device's implementation of the Bluetooth Audio/Video Control Transport Protocol (AVCTP). A network-adjacent attacker who successfully pairs a malicious Bluetooth device with the target can trigger the overflow by sending crafted AVCTP data. The vulnerability was reported through the Zero Day Initiative under identifier ZDI-CAN-26290 and tracked publicly as ZDI-25-356. Sony has published a firmware update to address the issue.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the affected Bluetooth process on the XAV-AX8500, compromising confidentiality, integrity, and availability of the in-vehicle system.

Affected Products

Sony XAV-AX8500 receiver (hardware)
Sony XAV-AX8500 firmware (all versions prior to the vendor fix referenced in advisory 00344092)
Deployments using the built-in Bluetooth AVCTP stack for A/V remote control

Discovery Timeline

2025-06-21 - CVE-2025-5479 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5479

Vulnerability Analysis

The vulnerability exists in the AVCTP handler used by the XAV-AX8500 Bluetooth stack. AVCTP transports Audio/Video Remote Control Profile (AVRCP) messages between paired Bluetooth endpoints. The XAV-AX8500 copies attacker-supplied AVCTP payload data into a fixed-size heap buffer without validating the declared length. When the supplied length exceeds the destination buffer, adjacent heap metadata and objects are overwritten. This is a classic heap-based buffer overflow classified under [CWE-122]. Corruption of function pointers or object vtables in the overwritten heap region enables control-flow hijacking within the affected process.

Root Cause

The root cause is missing length validation before a memory copy operation in the AVCTP parsing routine. The firmware trusts the length field embedded in the incoming AVCTP frame and issues a copy into a smaller destination allocation. No bounds check compares the attacker-controlled length against the destination capacity.

Attack Vector

Exploitation requires Bluetooth proximity and the ability to complete pairing with the XAV-AX8500. Once paired, the attacker sends malformed AVCTP frames containing an oversized payload. The overflow occurs during processing of the frame, before higher-layer AVRCP validation is reached. Because the affected component runs with elevated privileges on the head unit, successful exploitation yields code execution on the automotive infotainment system.

No verified public proof-of-concept code is available. Refer to the Zero Day Initiative Advisory ZDI-25-356 for additional technical context.

Detection Methods for CVE-2025-5479

Indicators of Compromise

Unexpected Bluetooth pairing requests or successful pairings with unknown devices near the vehicle
Repeated crashes, spontaneous reboots, or audio subsystem restarts on the XAV-AX8500 during Bluetooth sessions
AVCTP frames with length fields inconsistent with actual payload size captured via Bluetooth sniffers

Detection Strategies

Monitor Bluetooth pairing logs on the head unit for unauthorized device identifiers or MAC addresses
Use Bluetooth protocol analyzers such as Ellisys or Frontline to inspect AVCTP header length fields against observed payload sizes
Correlate infotainment error events with proximity of unknown Bluetooth devices during fleet operations

Monitoring Recommendations

Maintain an allowlist of paired mobile devices per vehicle and audit changes
Enable diagnostic logging on the XAV-AX8500 where supported and review after service intervals
For fleet operators, incorporate Bluetooth-adjacent anomaly detection into physical security monitoring around parked vehicles

How to Mitigate CVE-2025-5479

Immediate Actions Required

Apply the firmware update published by Sony under support reference 00344092 as soon as it can be scheduled
Remove unknown or stale paired devices from the XAV-AX8500 pairing list
Disable Bluetooth on the head unit when the feature is not required, particularly in shared or public parking environments

Patch Information

Sony has released a firmware update for the XAV-AX8500 that corrects the AVCTP length validation defect. Installation instructions and the update package are available from the Sony Software Update page. Apply the update using a USB drive following the vendor's documented procedure.

Workarounds

Turn off Bluetooth on the XAV-AX8500 until the firmware update has been installed
Restrict pairing operations to controlled environments where rogue transmitters are unlikely to be present
Physically unpair all previously trusted devices and re-pair only after applying the vendor firmware

bash

# Firmware update workflow (reference only - follow Sony documentation)
# 1. Download update package for XAV-AX8500 from Sony support 00344092
# 2. Format USB drive as FAT32 and copy the update file to the root directory
# 3. Insert USB into the XAV-AX8500 USB port with the vehicle ignition on
# 4. Confirm the update prompt on the head unit and wait for reboot
# 5. Verify installed firmware version via Settings > General > System Information