Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)

Metadata

Affected Target

Summary

CVE-2025-54957 is a critical out-of-bounds write vulnerability in Dolby’s DDPlus Unified Decoder, triggered while processing “evolution” data in an AC-3/EC-3 (Dolby Digital Plus) bitstream. An integer overflow in the length calculation for evolution-data writes causes the decoder to under-allocate a heap-like contiguous buffer embedded in a larger struct, while the corresponding bounds check on the write remains ineffective, allowing later struct members — including a function/data pointer used when the next syncframe is processed — to be overwritten. On Android, the decoder is invoked automatically to transcribe incoming audio messages/attachments, making this a zero-click vulnerability: a crafted RCS voice message alone can crash (and potentially further exploit) the target device’s media/messaging process without any user interaction. The PoC provides ready-to-use crash bitstreams and a containerized MP4 plus exact adb steps to reproduce the zero-click delivery path.

Vulnerability Details

Root Cause

When the DDPlus Unified Decoder processes “evolution” metadata within an EC-3 bitstream, it writes the evolution information into a large, heap-like buffer nested inside a larger decoder struct. The length used to size/bound that write is computed via an integer calculation that can wrap (overflow), causing the effectively “allocated” region to be smaller than assumed. Because the out-of-bounds check for the subsequent write relies on the same (already-overflowed) size value, the check is ineffective and the write proceeds past the intended buffer boundary — corrupting adjacent members of the containing struct, including a pointer that is dereferenced/written to when the decoder processes the next syncframe.

Attack Vector

1. Attacker crafts an EC-3 (Dolby Digital Plus) bitstream whose evolution-data field triggers the integer-overflow-driven under-allocation (see dolby_android_crash.ec3 / dolby_evo_crash32.ec3 in this folder — the latter targets 32-bit decoders since the former only crashes on 64-bit targets).
2. The bitstream is wrapped in a container (dolby_android_crash.mp4) so it can be delivered as a normal-looking audio/media attachment.
3. Delivery is zero-click on Android via RCS: the attacker sends an audio message; the receiving device’s messaging app (com.google.android.apps.messaging) automatically writes the incoming audio to a scratch cache directory (/data/user/0/com.google.android.apps.messaging/cache/mediascratchspace/) and invokes the Dolby decoder locally to transcribe it, with no user interaction required.
4. The malformed evolution data causes the OOB write described above, corrupting a pointer that is subsequently used when the next syncframe is parsed, leading to a crash (SIGSEGV on Android/Samsung, -bounds-safety trap on Apple’s hardened allocator) and potential further memory corruption.
5. Manual/local reproduction (non-zero-click, for lab verification) is done by pushing dolby_android_crash.mp4 into the same scratch cache path and having the media/transcription pipeline process it, or simply playing the MP4 on an Android device.

Impact

Denial of service (crash of the media/transcription/C2 process) confirmed across multiple real devices; the underlying pointer-overwrite primitive is a strong candidate for further exploitation toward remote code execution given the correct heap grooming, since it clobbers a pointer used on the next syncframe. On Android this is exploitable with zero user interaction via RCS voice messages, since audio attachments are auto-transcribed.

Environment / Lab Setup

Target:      Android 16 (confirmed Pixel 9 BP2A.250605.031.A2), Samsung S24 (S921U1UES4AYB3),
             macOS Tahoe 26.0.1 (MacBook Air M1), iOS 26.0.1 (iPhone 17 Pro) — any device
             using the Dolby Unified (DDPlus) decoder prior to the fix
Attacker:    A second Android test device capable of sending RCS messages to the target
Files:       dolby_android_crash.mp4, dolby_android_crash.ec3, dolby_evo_crash32.ec3 (this folder)
Tools:       adb (Android Debug Bridge) for manual scratch-cache reproduction

Proof of Concept

PoC Script

See dolby_android_crash.mp4, dolby_android_crash.ec3, and dolby_evo_crash32.ec3 in this folder.

1
2

adb -s TARGET_DEVICE shell ls -l /data/user/0/com.google.android.apps.messaging/cache/mediascratchspace/
adb -s TARGET_DEVICE push dolby_android_crash.mp4 /data/user/0/com.google.android.apps.messaging/cache/mediascratchspace/FILENAME

Detection & Indicators of Compromise

Signs of compromise:

• Unexplained crashes of the messaging or audio-transcription process correlated with received voice/audio messages.
• Crash logs or tombstones pointing into the Dolby Unified Decoder’s evolution-data handling code path.
• EC-3/AC-3 attachments with abnormal evolution metadata sizes that don’t match the codec spec.

Remediation

References

• Source repository
• Microsoft Security Response Center advisory — CVE-2025-54957
• ChromeOS stable channel update (2025-09-18) fixing the same issue

Notes

Mirrored from https://github.com/AlphabugX/CVE-2025-54957 on 2026-07-06. Contains actual crash-triggering bitstream/media PoC files for the Dolby decoder OOB write plus a detailed technical repro writeup. The repo author notes the bug is present on macOS but it is unclear whether it is reachable there due to pre-processing checks, and that they will update findings as further impacted devices are investigated. Confirmed crashes on Pixel 9 (Android 16), Samsung S24, MacBook Air M1 (macOS Tahoe), and iPhone 17 Pro (iOS 26.0.1).