Dolby Digital Plus 0-Click Vulnerability Enables RCE Attack via Malicious Audio on Android
A zero-click vulnerability has been identified in the Dolby Digital Plus (DDP) audio decoding software, which allows remote execution of malicious code through audio messages.
A zero-click vulnerability has been identified in the Dolby Digital Plus (DDP) audio decoding software, which allows remote execution of malicious code through audio messages.
The flaw was identified by Google Project Zero researchers and involves an out-of-bounds write issue in the DDPlus Unified Decoder. This results from an integer overflow during length calculations, leading to undersized buffer allocation. Consequently, this permits writes to bypass bounds checks, potentially overwriting key structure members, including pointers used in subsequent syncframes.
The vulnerability primarily affects devices using the decoder, with significant implications for Android users due to automatic processing of audio messages.
Devices using the Google Messages app and similar clients that incorporate the DDPlus decoder are at risk. Attackers may exploit this vulnerability by sending specially crafted audio files in formats such as .ec3 or .mp4 via RCS. These files, when processed automatically by the target's device, can lead to crashes or even arbitrary code execution.
The flaw was identified by Google Project Zero researchers and involves an out-of-bounds write issue in the DDPlus Unified Decoder.
Reproduction of this issue is feasible by embedding a crafted file like "dolby_android_crash.mp4" into the messaging app's cache and initiating an RCS voice message. Upon receipt, the target device processes the file, potentially leading to system crashes.
Further Implications and Recommendations
Research suggests that this vulnerability could be exploited in phishing campaigns or targeted attacks, enabling data theft or device compromise. Although patches are not currently available, users are advised to update their devices and messaging applications. The 90-day disclosure period concluded on Sat, Sep 24, 2025, with details now public.
The vulnerability also exists in macOS systems, although pre-processing steps may mitigate exploitation. Researchers are investigating potential impacts on other platforms, including iOS and Dolby-integrated systems like smart TVs and streaming devices.
Based on reporting by Cyber Security News.