CVE-2025-54957
Critical9.8An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.
- CVSS
- 9.8v3.1
- EPSS (exploit probability)
- 1.6%75th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-20 | 1.6% | 75.4% |
| 2026-10-19 | 1.6% | 75.4% |
| 2026-10-18 | 1.6% | 75.3% |
| 2026-10-16 | 1.6% | 75.3% |
| 2026-10-15 | 1.6% | 75.3% |
| 2026-10-14 | 1.6% | 75.2% |
| 2026-10-13 | 1.6% | 75.1% |
| 2026-10-12 | 1.6% | 75.0% |
| 2026-10-11 | 1.6% | 75.0% |
| 2026-10-10 | 1.6% | 75.0% |
| 2026-10-09 | 1.6% | 75.0% |
| 2026-10-08 | 1.6% | 75.0% |
| 2026-10-07 | 1.6% | 75.0% |
| 2026-10-06 | 1.6% | 74.9% |
| 2026-10-05 | 1.6% | 74.9% |
| 2026-10-04 | 1.6% | 74.9% |
| 2026-10-03 | 1.6% | 74.9% |
| 2026-10-02 | 1.6% | 74.9% |
| 2026-10-01 | 1.6% | 74.8% |
| 2026-09-30 | 1.6% | 74.8% |
| 2026-09-29 | 1.6% | 74.8% |
| 2026-09-27 | 1.6% | 74.7% |
| 2026-09-26 | 1.6% | 74.7% |
| 2026-09-25 | 1.6% | 74.7% |
| 2026-09-24 | 1.6% | 74.6% |
| 2026-09-23 | 1.6% | 74.7% |
| 2026-09-22 | 1.6% | 74.6% |
| 2026-09-21 | 1.6% | 74.2% |
| 2026-09-20 | 1.6% | 74.6% |
| 2026-09-19 | 1.6% | 74.5% |
| 2026-09-18 | 1.6% | 74.5% |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H