Zero-click Dolby audio bug lets attackers run code on Android and Windows devices

Zero-click Dolby audio bug lets attackers run code on Android and Windows devices, a medium-severity remote code execution vulnerability that affects Android (Samsung and Pixel devices) and Windows systems using Dolby UDC versions 4.5–4.13. Remote code execution means an attacker could run programmes on your device without your permission, and the flaw is triggered automatically when a device receives an audio message, with no tap or user action required.

The issue is tracked as CVE-2025-54957 and stems from how the Dolby UDC handles evolution data within Dolby Digital Plus audio streams. The vulnerability could be exploited by sending a target a specially crafted audio file, potentially allowing the attacker to run malicious code inside the audio-decoding process. According to Dolby, there is awareness of a report indicating an increased risk on Google Pixel devices and other Android devices could be at risk with similar vulnerabilities. The article notes that Dolby has issued a security advisory and that patches might be rolled into firmware and OS updates by device makers.