CRITICAL CWE-190
CVE-2025-54957
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash…
9.8/ 10
CVSS 3.1
Critical severity
1.6%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 76% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Oct 20, 2025
- Updated
- Feb 26, 2026
- First covered
- Jun 29, 2026
- Latest story
- 5 months ago
Summary
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.
CWE-190Integer Overflow or Wraparound
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H