Google's Pixel 9 devices are susceptible to a zero-click exploit chain that targets the Dolby Unified Decoder (UDC), a component responsible for processing Dolby Digital and Dolby Digital Plus audio formats. This vulnerability allows for arbitrary code execution within the mediacodec context of the device, forming the first stage of a more complex attack. The exploit chain was developed by Project Zero to demonstrate the practical implications of media decoder vulnerabilities and to highlight the effectiveness of zero-click attacks in modern Android security environments.
The issue stems from how the Dolby Unified Decoder handles Extensible Metadata Delivery Format (EMDF) data, which is embedded within audio streams. The decoder processes this data from a "skip buffer" after identifying a specific syncword. A key part of the EMDF structure is the `emdf_container_length` field, which specifies the size of the metadata container. However, the decoder's implementation lacks a proper check for the size of this container relative to the data available in the skip buffer.
Specifically, the decoder can read up to 0x1FF bytes per audio block from the bitstream into the skip buffer. Within this buffer, it looks for an EMDF container, defined by a syncword and a length field. The vulnerability arises because the `emdf_container_length` can be declared larger than the actual amount of data present in the skip buffer, which is constrained by the `skipl` field.
When the decoder attempts to read the EMDF payload based on the declared `emdf_container_length`, it can read beyond the bounds of the allocated buffer. While the decoder allocates memory for the EMDF payload, a flawed integer overflow check in the memory allocation function, `ddp_udc_int_evo_malloc`, can lead to a smaller-than-expected buffer being allocated. This occurs when the calculated total allocation size falls within a specific range that causes an integer overflow on 64-bit systems.
Despite the potential for a large write, the exploit is mitigated by a read bounds check within the `ddp_udc_int_evo_brw_read` function. This function checks against the `emdf_container_length` to ensure it doesn't read beyond the container's declared size. However, this check also allows an attacker to control the size of the overflow and the values written out of bounds, up to the limit of the skip buffer's capacity. This capability, termed "buffer overrun," provides a powerful primitive for attackers.
Furthermore, the vulnerability includes a data leak. The EMDF content is written to the skip buffer based on `skipl`, but the EMDF container's declared size (`emdf_container_length`) dictates how much data the bit reader attempts to process. If `emdf_container_length` is larger than `skipl`, the bit reader will attempt to access data beyond the skip buffer's boundaries, potentially revealing information or enabling further exploitation.
The Dolby Unified Decoder is integrated into various platforms, including Android, iOS, and media streaming devices. On the Pixel 9, it is found in the `/vendor/lib64/libcodec2_soft_ddpdec.so` library. The vulnerabilities discussed, CVE-2025-54957 and CVE-2025-36934, were addressed by Google as of January 5, 2026.
This research, detailed in a series of blog posts, aims to educate defenders about the nature of zero-click attacks, the efficacy of media decoder vulnerabilities, and the strengths and weaknesses of Android's security measures. The subsequent parts of the series will delve into privilege escalation from the mediacodec context to the kernel and offer recommendations for preventing similar exploits.
