Vulnerability · NVD
CVE-2025-54957
CVE-2025-54957 : critical severity (CVSS 9.8). No tracked catalog app is linked to this CVE.
- Severity (CVSS)
- 9.8
- Exploitation
- 1.6 %
- Tracked apps
- 0
- Still exposed
- 0
NVD scale
EPSS, predicted over 30 days
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.
Show raw CVSS vector
OS versions that fix this CVE
This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.
- Android Fixed in January 2026 patch level
- Windows Server 2025 Fixed in 10.0.26100.6899
- Windows Server 2022 (Server Core installation) Fixed in 10.0.20348.4294
- Windows Server 2022 Fixed in 10.0.25398.1913
- Windows Server 2019 Fixed in 10.0.17763.7919
- Windows Server 2016 Fixed in 10.0.14393.8519
- Windows 11 25H2 · 2025-H2 Fixed in 10.0.26200.6899
- Windows 11 24H2 · 2024-H2 Fixed in 10.0.26100.6899
- Windows 11 23H2 · 2023-H2 Fixed in 10.0.22631.6060
- Windows 11 22H2 · 2022-H2 Fixed in 10.0.22621.6060
- Windows 10 22H2 · 2022-H2 Fixed in 10.0.19045.6456
- Windows 10 21H2 · 2021-H2 Fixed in 10.0.19044.6456
- Windows 10 1809 · 2018-09 Fixed in 10.0.17763.7919
- Windows 10 1607 · 2016-07 Fixed in 10.0.14393.8519
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.