{"id":153878,"date":"2026-01-17T11:12:33","date_gmt":"2026-01-17T09:12:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya"},"modified":"2026-01-17T11:12:33","modified_gmt":"2026-01-17T09:12:33","slug":"uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","title":{"rendered":"Vulnerability in Android firmware allowing code execution via message sending","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from Google Project Zero have thoroughly analyzed a technique for creating a working exploit that allows remote code execution with Linux kernel privileges by sending an SMS or RCS message containing a specially crafted audio attachment. The attack occurs without any action from the user, including not requiring them to view or listen to the received message. <\/p>\n

The exploit involves two vulnerabilities: in the Dolby Unified Decoder library (CVE-2025-54957) and in the bigwave driver for the Linux kernel (CVE-2025-36934). Previously, exploiting vulnerabilities in codecs required the user to listen to or view the received malicious content. With the integration of AI assistants in recent Android firmware releases, the received multimedia content is automatically decoded upon receipt, significantly increasing the attack surface without user actions (0-click). In the context of audio SMS and RCS messages, the Google Messages app uses the com.google.android.tts service to automatically generate a transcript for applying to audio messages for text searches, enabling vulnerability exploitation in existing audio codecs without user involvement. <\/p>\n

The issue in the Dolby Unified Decoder is caused by an integer overflow when calculating the buffer size for the syncframe data structures, which can be exploited to write beyond the allocated buffer. This overflow may overwrite a pointer used when processing the next syncframe, allowing an attacker to overwrite a function pointer with controlled data and execute their code with the rights of \u2018mediacodec\u2019, which are restricted through SELinux. <\/p>\n

The exploitation of the Linux kernel was made possible by a vulnerability in the bigwave driver, which is responsible for handling the character device \/dev\/bigwave, accessible from the SELinux context \u2018mediacodec\u2019. This vulnerability allowed for the overwriting of kernel structures via manipulations with the BIGO_IOCX_PROCESS ioctl call, enabling the execution of code with kernel privileges. <\/p>\n

A vulnerability in the Dolby Unified Decoder library (libcodec2_soft_ddpdec.so), which provides functionalities for decoding Dolby Digital (DD, AC-3) and Dolby Digital Plus (DD+, EAC-3) formats, is not specific to Android or the firmware for Pixel 9, and also manifests on other platforms (Samsung S24, MacBook Air M1, iPhone 17 Pro, Windows, ChromeOS, etc.). In the Android AOSP repository and the firmware for Samsung S24, a seccomp syscall filter is applied to processes running in the context of mediacodec, making further exploitation of vulnerabilities in the kernel more difficult. Such a filter was absent in the firmware for Pixel 9. attacks could be mitigated by<\/a> The Memory Tagging mechanism (MTE) is available for Pixel 8+ devices only as an option, which can be activated when enabling \u2018Advanced Protection\u2019 mode. In macOS and iOS, exploitation is complicated by building the library with the \u2018-fbounds-safety\u2019 flag, which adds additional checks for array bounds that reduce performance. <\/p>\n

Researchers are separately addressing issues related to the delivery of the vulnerability fix for the Dolby Unified Decoder to users. Information about the vulnerability was disclosed publicly 82 days before the fix was delivered to Pixel device users. Dolby was informed of the issue on June 26, 2025. The first binary fix was released on September 18 for ChromeOS, but for Android devices, Dolby provided binary patches only on October 8. On October 15, information about the vulnerability was publicly disclosed. Samsung released a fix on November 12, and only on January 5 was a fix published for Pixel devices. The distribution of the patch for all Android devices took 139 days. <\/p>\n

A vulnerability was discovered in the Dolby Unified Decoder in less than two days, while the BigWave driver vulnerability took less than a day to review. The development efforts required to create a working exploit for the Dolby Unified Decoder vulnerability were estimated at 8 weeks for one researcher, while for BigWave it was 3 weeks. In the report published on October 14, Dolby labeled the vulnerability in the Dolby Unified Decoder as having a low level of severity, despite providing details about the developing exploit. The vulnerabilities in BigWave were assigned a moderate severity level in Android, justified by the fact that an attack is only possible from privileged content and not accessible from unprivileged contexts (three months later, the status of the vulnerability was changed to \u2018critical issue\u2019).
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0432\u0443\u043a\u043e\u0432\u044b\u043c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \u0410\u0442\u0430\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f. \u0412 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-153878","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerability in Android firmware allowing code execution via message sending | ProHoster","description":"Researchers from the Google Project Zero team detailed a technique for creating a working exploit that allows remote code execution with kernel privileges in Linux, by sending an SMS or RCS message with specific content.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-17T09:12:33+00:00","article:modified_time":"2026-01-17T09:12:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"153878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 15:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 14:13:19","updated":"2026-01-24 15:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/153878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=153878"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/153878\/revisions"}],"predecessor-version":[{"id":154931,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/153878\/revisions\/154931"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=153878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=153878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=153878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}