# cve.now: Sony

The newest entries naming Sony as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116104](https://cve.now/CVE-2026-116104.md): Sony Neural Network Libraries NNP Converter utils.py func\_set\_nnabla\_version\_decorate code injection (CVSS 5.3)
- [CVE-2026-116103](https://cve.now/CVE-2026-116103.md): Sony Neural Network Libraries Encode Param encode\_decode\_param.py load\_param\_in\_txt code injection (CVSS 5.3)
- [CVE-2026-18284](https://cve.now/CVE-2026-18284.md): Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability (CVSS 7.8)
- [CVE-2026-18283](https://cve.now/CVE-2026-18283.md): Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability (CVSS 2.4)
- [CVE-2026-18282](https://cve.now/CVE-2026-18282.md): Sony XAV-9500ES AVRCP\_Br\_Response\_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0)
- [CVE-2026-18281](https://cve.now/CVE-2026-18281.md): Sony XAV-9500ES l2\_reassemble\_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0)
- [CVE-2026-18280](https://cve.now/CVE-2026-18280.md): Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability (CVSS 3.9)
- [CVE-2026-18279](https://cve.now/CVE-2026-18279.md): Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2026-18278](https://cve.now/CVE-2026-18278.md): Sony XAV-9500ES prh\_l2\_decode\_packet Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.5)
- [CVE-2026-59776](https://cve.now/CVE-2026-59776.md): Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. (CVSS 6.8)
- [CVE-2026-50255](https://cve.now/CVE-2026-50255.md): Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. (CVSS 6.7)
- [CVE-2025-64390](https://cve.now/CVE-2025-64390.md): A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. (CVSS 7.4)
- [CVE-2025-64772](https://cve.now/CVE-2025-64772.md): The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Li (CVSS 7.8)
- [CVE-2025-64730](https://cve.now/CVE-2025-64730.md): Cross-site scripting vulnerability exists in SNC-CX600W all versions. (CVSS 5.2)
- [CVE-2025-62497](https://cve.now/CVE-2025-62497.md): Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. (CVSS 3.1)
- [CVE-2025-62225](https://cve.now/CVE-2025-62225.md): Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. (CVSS 6.7)
- [CVE-2025-5475](https://cve.now/CVE-2025-5475.md): Sony XAV-AX8500 Bluetooth Packet Handling Integer Overflow Remote Code Execution Vulnerability (CVSS 7.5)
- [CVE-2025-5477](https://cve.now/CVE-2025-5477.md): Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5)
- [CVE-2025-5478](https://cve.now/CVE-2025-5478.md): Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2025-5479](https://cve.now/CVE-2025-5479.md): Sony XAV-AX8500 Bluetooth AVCTP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5)
- [CVE-2025-5476](https://cve.now/CVE-2025-5476.md): Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability (CVSS 6.3)
- [CVE-2025-5820](https://cve.now/CVE-2025-5820.md): Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability (CVSS 6.3)
- [CVE-2025-5124](https://cve.now/CVE-2025-5124.md): Sony SNC-M1 Administrative Interface default credentials (CVSS 9.2)
- [CVE-2024-23922](https://cve.now/CVE-2024-23922.md): Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability (CVSS 6.8)
- [CVE-2024-23972](https://cve.now/CVE-2024-23972.md): Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8)
- [CVE-2024-23934](https://cve.now/CVE-2024-23934.md): Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2024-23933](https://cve.now/CVE-2024-23933.md): Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8)
- [CVE-2022-41796](https://cve.now/CVE-2022-41796.md): Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileg (CVSS 7.8)
- [CVE-2022-3349](https://cve.now/CVE-2022-3349.md): Sony PS4/PS5 exFAT UVFAT\_readupcasetable heap-based overflow (CVSS 6.8)
- [CVE-2021-20793](https://cve.now/CVE-2021-20793.md): Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1. (no CVSS)
- [CVE-2020-5589](https://cve.now/CVE-2020-5589.md): SONY Wireless Headphones WF-1000X, WF-SP700N, WH-1000XM2, WH-1000XM3, WH-CH700N, WH-H900N, WH-XB700, WH-XB900N, WI-1000X, WI-C600N and WI-SP (no CVSS)
- [CVE-2019-5982](https://cve.now/CVE-2019-5982.md): Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-mid (no CVSS)
- [CVE-2019-5981](https://cve.now/CVE-2019-5981.md): Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with ad (no CVSS)
- [CVE-2018-0656](https://cve.now/CVE-2018-0656.md): Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privile (no CVSS)
- [CVE-2018-0600](https://cve.now/CVE-2018-0600.md): Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain priv (no CVSS)
- [CVE-2017-2287](https://cve.now/CVE-2017-2287.md): Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan (no CVSS)
- [CVE-2017-2286](https://cve.now/CVE-2017-2286.md): Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S3 (no CVSS)
- [CVE-2017-2277](https://cve.now/CVE-2017-2277.md): WG-C10 v3.0.79 and earlier allows an attacker to bypass access restrictions to obtain or alter information stored in the external storage co (no CVSS)
- [CVE-2017-2276](https://cve.now/CVE-2017-2276.md): Buffer overflow in WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary commands via unspecified vectors. (no CVSS)
- [CVE-2017-2275](https://cve.now/CVE-2017-2275.md): WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS)
- [CVE-2016-7830](https://cve.now/CVE-2016-7830.md): Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sony
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.