Loading story…
A critical zero-click remote code execution (RCE) vulnerability has been discovered in the Dolby Unified Decoder, a widely used audio format processing component present in Android, iOS, and macOS devices. The flaw, tracked as CVE-2025-54957, is a high-severity out-of-bounds write issue that can be exploited by threat actors through maliciously crafted audio messages. According to Google Project Zero researchers Ivan Fratric and Natalie Silvanovich, the vulnerability arises from improper handling of evolution data within the decoder. Specifically, the decoder writes evolution information into a large, heap-like buffer, but a flaw in the length calculation due to integer wrap can result in overwriting later members of the struct, including critical pointers. This memory corruption can be triggered without any user interaction, making it a zero-click attack vector, particularly on Android devices. The vulnerability allows attackers to execute arbitrary code remotely, posing a significant risk to affected systems. Google has responded by releasing patches for ChromeOS to address the issue, demonstrating the cross-platform impact of the vulnerability. Microsoft has also included a fix for the flaw in its latest Patch Tuesday updates, indicating that Windows systems utilizing the Dolby decoder may also be at risk. The vulnerability's zero-click nature means that users could be compromised simply by receiving a malicious audio file, without needing to open or interact with it. Security researchers emphasize the importance of promptly applying available patches to mitigate the risk of exploitation. The discovery highlights the ongoing challenges in securing complex multimedia processing components, which are often integrated into a wide range of consumer and enterprise devices. The flaw's technical details, including the specific buffer overflow mechanism and the potential for pointer overwrites, underscore the sophistication required to both discover and exploit such vulnerabilities. The coordinated disclosure and rapid patching efforts by Google and Microsoft reflect the seriousness of the threat. Organizations are advised to review their exposure to the Dolby Unified Decoder and ensure all relevant updates are applied. The incident serves as a reminder of the critical need for robust security testing in third-party components embedded within operating systems and applications. Ongoing monitoring for exploitation attempts is recommended, as threat actors may attempt to reverse-engineer the patches to develop working exploits. The vulnerability's impact across multiple platforms increases its attractiveness to attackers, making timely remediation essential for both individual users and enterprises.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A security researcher publicly detailed a zero-click remote code execution vulnerability in the Dolby audio decoder, reporting that it could affect Android, iOS, and macOS devices. The available references indicate disclosure of the bug and its attack potential, but do not provide an earlier discovery or patch date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a security update in November 2025 to address a critical remote code execution vulnerability, CVE-2025-48593, in the Android System component. This flaw allows attackers to execute code remotely on affected devices running Android versions 13 through 16 without requiring user interaction or additional execution privileges. The vulnerability stems from insufficient validation of user input, making it possible for exploitation via a zero-click attack vector. The update also addressed a separate privilege escalation issue, CVE-2025-48581, affecting Android 16, but the primary concern is the zero-click RCE, which requires immediate patching due to its severity. Google has stated that there is no evidence of active exploitation in the wild at the time of the update. Security experts urge all users and organizations to apply the November 2025 security patch promptly to mitigate the risk posed by this critical vulnerability.
Jun 29, 2026
Google Project Zero disclosed a **zero-click exploit chain** for unpatched **Pixel 10** devices that achieved full root compromise by combining a Dolby Media Framework remote code execution path with a privilege-escalation flaw in the Tensor G5 ` /dev/vpu ` driver. The chain adapted an earlier Pixel 9 technique built around `CVE-2025-54957`, but required changes for Pixel 10, including a different approach to bypass protections such as Return Address Pointer Authentication by targeting `dap_cpdp_init` instead of the older `__stack_chk_fail` overwrite method. The local privilege-escalation bug was found in the Chips&Media Wave677DV VPU driver’s `mmap` handler, which failed to properly limit mappings to the MMIO register region and allowed userspace to map arbitrary physical memory, including kernel memory, through `remap_pfn_range`. Researchers said the flaw enabled arbitrary kernel read/write and kernel code execution because Pixel devices exposed the kernel at a predictable physical address. Google received the report on 2025-11-24, rated it **High** severity under Android VRP, and patched it 71 days later in the February Pixel security bulletin, while the disclosure renewed criticism of recurring shallow security flaws in Android drivers tied to the same developers behind earlier BigWave issues.
Jun 29, 2026
A critical vulnerability, CVE-2025-50165, was discovered in the Windows Imaging Component (WIC), specifically within the WindowsCodecs.dll library. The flaw arises from the dereferencing of an uninitialized function pointer during the compression and re-encoding of JPEG images with 12-bit or 16-bit color depth, rather than during standard image decoding or rendering. Security researchers from ESET and Zscaler have analyzed the vulnerability, confirming that it could potentially allow remote code execution if a specially crafted JPEG file is processed by a vulnerable application that performs re-encoding, such as during thumbnail creation. Despite the initial classification as a critical remote code execution risk, further technical analysis indicates that real-world exploitation is significantly constrained. Successful exploitation requires a precise set of conditions: the target application must use a vulnerable version of WindowsCodecs.dll and must re-encode, not just display, a malicious JPEG file. Simply opening or viewing a crafted image is insufficient to trigger the vulnerability, reducing the likelihood of mass exploitation. Microsoft has released a patch, and security experts recommend applying it, but the practical risk is lower than originally feared due to the complexity of the attack scenario.
Jun 29, 2026