Pixel 9 0-Click Exploit Chain: Dolby Codec Bug Meets AI Transcription

AI transcription put audio codecs back in the 0-click blast radius

Google Messages now automatically decodes incoming SMS and RCS audio attachments so it can transcribe and search them on-device — before the recipient ever opens the message. That auto-decode step is exactly the kind of "message arrives, code runs" primitive that defined the Stagefright era of Android media-parsing bugs. Google Project Zero's Natalie Silvanovich just demonstrated that this class of attack surface didn't go away — it moved into the codecs that AI features now invoke automatically.

The bug: an integer overflow in Dolby's Unified Decoder

CVE-2025-54957 lives in Dolby's Unified Decoder (UDC), the audio codec many Android OEMs — and some Windows systems — license for Dolby Digital Plus playback. While parsing the Extensible Metadata Delivery Format (EMDF) block inside a DD+ file, an allocation-size calculation can wrap around on 64-bit systems, producing an undersized buffer. The subsequent write loop still uses the original, larger payload length, corrupting heap memory — a classic out-of-bounds write caused by an unchecked integer overflow. Silvanovich and Ivan Fratric reported it to Dolby; Project Zero calls it likely present "in the 0-click attack surface of most Android devices in use today."

From a corrupted heap to a Pixel 9 kernel

Project Zero got 0-click code execution inside the sandboxed mediacodec process on a Pixel 9 running Android 16. To turn that into something more useful, they chained it with a second bug, CVE-2025-36934 — a flaw in the BigWave kernel driver, reachable from the codec sandbox, that let them overwrite kernel structures via a crafted ioctl call and escalate to kernel-level read/write. Seth Jenkins found that driver bug after less than a day reviewing it. Notably, the escalation only worked because Pixel 9's codec sandbox lacked a restrictive seccomp filter blocking access to that driver — Samsung's S24 applied one and was not vulnerable to this specific escalation path, even though the underlying Dolby bug affected it too.

Why this reaches beyond one phone

Dolby's UDC isn't Pixel-specific: it's embedded across many Android OEM media stacks and in Windows systems running affected UDC versions. Both vulnerabilities were reported to their respective vendors in June 2025, and fixes shipped in Android's January 2026 security update (the BigWave driver fix landed January 6, 2026). Devices running an older patch level, or an OEM build that hasn't backported the fix, remain exposed to the same 0-click chain.

What this means for security teams

• Patch to the January 2026 or later Android security level across the fleet, and confirm OEM/carrier builds actually backported CVE-2025-54957 and CVE-2025-36934 rather than just bumping a version string.
• Track Dolby UDC exposure outside Android too — Windows hosts running affected UDC builds fall under the same advisory.
• Treat sandbox depth as a real mitigation layer, not boilerplate: the Samsung S24 case shows a tighter seccomp policy on the codec process stopped the kernel-escalation half of this chain outright.
• Model "AI convenience" features — auto-transcription, auto-summarization, on-device search — as attack-surface decisions. Anything that decodes untrusted media before a user interacts with it is a candidate 0-click entry point and belongs in your mobile threat model and fuzzing scope.

Frequently asked questions