CVE-2025-54957

Dolby UDC and Affected Versions Dolby UDC versions 4.5 through 4.13

Description A flaw exists in the Dolby Unified Decoder (UDC) that could allow remote attackers to execute arbitrary code. The issue stems from an out-of-bounds write vulnerability within the DD+ decoder process when processing malformed DD+ bitstreams. Specifically, an integer overflow occurs during the length calculation when processing Evolution data via the

evo priv.c

component, leading to a buffer overflow. This allows attackers to overwrite data structures, potentially including pointers, enabling remote code execution. On Android devices, this vulnerability can be exploited remotely without user interaction, as audio messages and attachments are decoded locally by the UDC. A proof-of-concept (PoC) exploit has been demonstrated on Android (Pixel 9, Samsung S24) and macOS devices. The vulnerability is tracked as CVE-2025-54957. The vulnerability allows remote attackers to execute arbitrary code and affect the system.

Recommendations Update to a newer version of Dolby UDC that contains a fix for this vulnerability.