Vulnerability in Dolby Decoder Can Allow Zero-Click Attacks

A high-severity vulnerability in Dolby’s Unified Decoder could be exploited for remote code execution without user interaction in certain cases. The flaw, tracked as CVE-2025-54957 with a CVSS score of 7.0, stems from an out-of-bounds write in the decoder when processing evolution data and could be triggered by malicious audio messages to run code remotely.

On Android, the vulnerability can be exploited remotely without user interaction because all audio messages and attachments are decoded locally using Dolby’s Unified Decoder, according to Google Project Zero.

The security researcher team published proof‑of‑concept exploit code demonstrating a 0‑click code execution in the mediacodec context on a Pixel 9 running version 16 BP2A.250605.031.A2, and fixes have been rolled out after Google disclosed the defect to Dolby Laboratories in June, with Microsoft noting that user interaction is required for exploitation on Windows. Patches were included in the latest ChromeOS updates as part of the response.