Google fixes critical Dolby Decoder bug in Android January update

Google’s January 2026 Android security update fixes a critical flaw in Dolby’s DDPlus audio decoder, tracked as CVE-2025-54957. The vulnerability could cause an out-of-bounds write when processing a specially crafted DD+ bitstream, potentially increasing risk on Android devices, including Pixel, when chained with other vulnerabilities.

The issue was discovered by Google Project Zero researchers in October 2025, with Google stating that an integer overflow can trigger the out-of-bounds write in UDC v4.5–v4.13, and that on Android it is a 0-click bug since audio is decoded automatically. According to Google Project Zero’s report, the double-risk scenario involves the evolution data being processed and could allow later struct members to be overwritten. Google fixed the flaw in December 2025 for Pixel phones and has now rolled out the fix to all Android devices as part of the January 2026 update.