Critical Dolby Vulnerability Patched in Android

SecurityWeek reports that a critical Dolby audio decoder vulnerability, tracked as CVE-2025-54957, was patched in the January 2026 Android update. The flaw, described as a medium-severity out-of-bounds write issue in the Dolby Digital Plus Unified Decoder, can be exploited by specially crafted media files, with researchers noting zero-click remote code execution on Android devices.

Google researchers disclosed the vulnerability in October 2025, and Dolby released a patch in September 2025 after being informed in June 2025. The January 2026 Android security bulletin confirms the patch for all Android devices, following Google's December 2025 Pixel update that addressed the flaw on Pixel phones. According to Adam Boynton, senior security strategy manager at Jamf, on Android OS audio attachments and voice messages are decoded locally, enabling exploitation without user interaction.

The article also notes that the vulnerability’s existence was publicly teased as headlines emerged in October, and that the Android patch is part of the ongoing update cycle.