CVE-2025-54957: 
vulnerability analysis and mitigation

A buffer overflow vulnerability (CVE-2025-54957) was discovered in Dolby UDC versions 4.5 through 4.13. The vulnerability was disclosed on October 14, 2025, affecting the DD+ decoder process when handling malformed DD+ bitstreams (NVD, Dolby Advisory).

The vulnerability occurs in the Evolution data processing within the evo_priv.c component of the DD+ bitstream decoder. When processing Evolution data, an integer wraparound can occur during length calculation, resulting in an insufficient buffer allocation. This leads to an ineffective out-of-bounds check during subsequent write operations, ultimately causing an out-of-bounds write condition. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD).

The vulnerability can lead to a crash of the DD+ decoder process when processing malformed DD+ bitstreams. The out-of-bounds write condition could potentially allow for information disclosure and limited system impact, as indicated by the CVSS scoring metrics showing low confidentiality and integrity impact (NVD).

The vulnerability has been classified with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) to exploit. The attack vector is network-based (AV:N), indicating the vulnerability can be exploited remotely (NVD).