PT-2025-25256 · Sony · Sony Xav-Ax8500

Konatabrk + 1 · Published 2025-06-11 · Updated 2025-06-21 · CVE-2025-5477

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sony XAV-AX8500 (affected versions not specified)

Description The issue is related to a heap-based buffer overflow in the Bluetooth L2CAP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own. The estimated number of potentially affected devices worldwide is not provided.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2025-5477

ZDI-25-354

Affected Products

Sony Xav-Ax8500

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-5477 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-354 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5477 · Vendor Advisory
• https://twitter.com/TheZDIBugs/status/1932895836012179780 · Twitter Post
• https://t.me/latest_high_impact_cve/2747 · Telegram Post
• https://twitter.com/CVEnew/status/1936472509378867675 · Twitter Post
• https://t.me/cvetracker/26717 · Telegram Post
• https://sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax8500/software/00344092 · Vendor Advisory, Patch