CVE-2025-54957 -- CVSS 9.8 Vulnerability Briefing

CVE-2025-54957 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2025-54957 is a critical integer overflow leading to an out-of-bounds write vulnerability in the Dolby Universal Decoder Core (UDC) versions 4.5 through 4.13, specifically within the DD+ (Dolby Digital Plus) decoder component.

Technical Detail

The flaw resides in evo_priv.c, where Evolution data extracted from a malformed DD+ bitstream is written into a heap-allocated buffer. A length calculation for that write operation is susceptible to integer wraparound, causing the allocated buffer size to be computed as smaller than required and rendering the subsequent out-of-bounds write check ineffective. Successful exploitation of a crafted DD+ bitstream can crash the decoder process and, depending on the deployment context, may allow an attacker to achieve arbitrary code execution in the process handling the malformed media stream.

Exploitation Status

A proof-of-concept is publicly available. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed evidence of active exploitation in the wild as of this writing. The availability of a PoC lowers the barrier for motivated actors to develop functional exploits, particularly given the straightforward trigger mechanism of supplying a crafted bitstream.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been identified in connection with this vulnerability.

What To Do

Organizations and device manufacturers integrating Dolby UDC versions 4.5 through 4.13 should apply the vendor-supplied patch immediately, prioritizing any internet-facing or user-accessible media processing pipelines. Given the critical CVSS score of 9.8 and the availability of a public PoC, patching should be treated as high priority and not deferred. Where patching is not immediately possible, restrict the acceptance of DD+ bitstream content to trusted, validated sources and implement process isolation or sandboxing around the decoder to limit the blast radius of a successful exploit. Detection efforts should focus on anomalous crashes or restarts of the DD+ decoder process, which may indicate exploitation attempts.