CVE-2025-54957 Integer overflow in n/a
An integer overflow in the Dolby DD+ decoder allows out-of-bounds writes, potentially leading to code execution or crashes on Android devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54957?
CVE-2025-54957 is a critical vulnerability in n/a, published on 20 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.
Which versions are affected by CVE-2025-54957?
How do I fix CVE-2025-54957?
Apply the vendor's patch.
Is CVE-2025-54957 being exploited?
There is no known exploitation of CVE-2025-54957 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as A-438955204, ASB-A-438955204, GHSA-rj4r-gj6w-jfgc, PUB-A-438955204.