CVE-2025-54957
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-21
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dolby | digital_plus | 4.13 |
| dolby | digital_plus | 4.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds write flaw in the Dolby Digital Plus (DD+) decoder versions UDC 4.5 through 4.13. It occurs when processing a specially crafted DD+ bitstream that causes an integer overflow during length calculation, leading to a buffer that is too small. This results in an ineffective out-of-bounds check and a subsequent out-of-bounds write, which can cause the DD+ decoder process to crash or potentially allow code execution. [1]
How can this vulnerability impact me? :
The impact depends on the device. On Google Pixel devices, this vulnerability may increase the risk of exploitation, especially when combined with other known vulnerabilities, potentially allowing code execution. On other Android devices, similar risks exist. For other device types, the main effect is a media player crash or restart, which is a lower risk. Users are advised to keep their devices updated and enable automatic updates to mitigate this risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when processing a uniquely crafted, manually edited but still valid DD+ bitstream that causes the DD+ decoder process to crash. Detection can involve monitoring for unexpected crashes or restarts of media player applications or the DD+ decoder process. Since the malformed bitstream cannot be generated by standard Dolby authoring tools, detection might include capturing and analyzing DD+ bitstreams for unusual or manually edited content. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include keeping devices updated and enabling automatic updates when possible. OEMs using Dolby DD+ are advised to contact Dolby for updated deliverables that address this vulnerability. Monitoring for media player crashes and applying vendor patches promptly are recommended. [1]