CVE-2025-54957: Integer Overflow
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evopriv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.
Other sources
Deserialization of untrusted data in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
— Microsoft
MITRE CVE-2025-54957: Integer overflow in Dolby Digital Plus audio decoder
— Microsoft
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-54957?
CVE-2025-54957 has a critical severity rating as it allows unauthorized code execution through deserialization of untrusted data in the Microsoft Windows Codecs Library.
How do I fix CVE-2025-54957?
To fix CVE-2025-54957, apply the relevant security patches provided by Microsoft for your specific version of Windows.
What systems are affected by CVE-2025-54957?
CVE-2025-54957 affects various versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server 2022 and 2016.
What type of vulnerability is CVE-2025-54957?
CVE-2025-54957 is a deserialization vulnerability that can be exploited to execute code locally.
Can CVE-2025-54957 be exploited remotely?
CVE-2025-54957 cannot be exploited remotely as it requires local execution of code through the affected software.