A Google Project Zero team researchers have detailed a method for creating a working exploit that allows remote execution of code with Linux kernel permissions via an SMS or RCS message containing a specially crafted audio attachment. The attack occurs without any actions required from the user, including not needing to view or listen to the received message. <\/p>\n
The exploit involves two vulnerabilities: in the Dolby Unified Decoder library (CVE-2025-54957) and in the bigwave driver for the Linux kernel (CVE-2025-36934). Previously, to exploit vulnerabilities in codecs, the user needed to listen to or view the received malicious content. However, with the integration of AI assistants in the latest Android firmware releases, the received multimedia content is automatically decoded upon receipt, significantly increasing the attack surface that does not require user actions (0-click). In the context of audio SMS and RCS messages, the Google Messages application, using the com.google.android.tts service, automatically generates a transcription for application in textual searches of audio messages, allowing vulnerabilities in existing audio codecs to be exploited without user involvement. <\/p>\n
A Dolby Unified Decoder probl\u00e9ma egy eg\u00e9sz sz\u00e1mok t\u00falfut\u00e1s\u00e1b\u00f3l ad\u00f3dik, amely a syncframe adatstrukt\u00far\u00e1khoz sz\u00fcks\u00e9ges puffer m\u00e9ret\u00e9nek kisz\u00e1m\u00edt\u00e1sa sor\u00e1n l\u00e9p fel, lehet\u0151v\u00e9 t\u00e9ve a puffer t\u00fall\u00e9p\u00e9s\u00e9t. A t\u00falfut\u00e1s k\u00f6vetkezt\u00e9ben fel\u00fcl\u00edr\u00f3dhat az a mutat\u00f3, amelyet a k\u00f6vetkez\u0151 szinkroniz\u00e1l\u00f3 k\u00e9pkocka feldolgoz\u00e1s\u00e1hoz haszn\u00e1lnak, amelynek megv\u00e1ltoztat\u00e1sa viszont lehet\u0151v\u00e9 teszi, hogy az t\u00e1mad\u00f3 \u00e1ltal ir\u00e1ny\u00edtott adatokkal fel\u00fcl\u00edrja a funkci\u00f3 mutat\u00f3j\u00e1t, \u00e9s a \u201emediacodec\u201d jogosults\u00e1gokkal rendelkez\u0151 k\u00f3d futtat\u00e1s\u00e1t v\u00e9gezze a SELinux \u00e1ltal korl\u00e1tozott m\u00f3don. <\/p>\n
A Linux kernel kihaszn\u00e1l\u00e1s\u00e1hoz egy sebezhet\u0151s\u00e9get haszn\u00e1ltak a bigwave meghajt\u00f3ban, amely a \/dev\/bigwave karakteres eszk\u00f6z kezel\u00e9s\u00e9\u00e9rt felel\u0151s, \u00e9s amelyhez SELinux \u201emediacodec\u201d k\u00f6rnyezetb\u0151l ny\u00fajtottak hozz\u00e1f\u00e9r\u00e9st. A sebezhet\u0151s\u00e9g lehet\u0151v\u00e9 tette a kernel strukt\u00far\u00e1inak fel\u00fcl\u00edr\u00e1s\u00e1t az BIGO_IOCX_PROCESS ioctl h\u00edv\u00e1ssal t\u00f6rt\u00e9n\u0151 manipul\u00e1ci\u00f3val, \u00edgy lehet\u0151v\u00e9 t\u00e9ve a k\u00f3d kernel jogosults\u00e1gokkal val\u00f3 futtat\u00e1s\u00e1t. <\/p>\n
A Dolby Unified Decoder (libcodec2_soft_ddpdec.so) k\u00f6nyvt\u00e1r\u00e1ban l\u00e9v\u0151 sebezhet\u0151s\u00e9g, amely Dolby Digital (DD, AC-3) \u00e9s Dolby Digital Plus (DD+, EAC-3) form\u00e1tumok dek\u00f3dol\u00e1s\u00e1hoz ny\u00fajt funkci\u00f3kat, nem specifikus az Android \u00e9s a Pixel 9 firmware sz\u00e1m\u00e1ra, \u00e9s m\u00e1s platformokon is megjelenik (Samsung S24, MacBook Air M1, iPhone 17 Pro, Windows, ChromeOS stb.). Az Android AOSP t\u00e1rol\u00f3j\u00e1ban \u00e9s a Samsung S24 firmware-j\u00e9ben a mediacodec kontextus\u00e1ban fut\u00f3 folyamatokhoz seccomp rendszerh\u00edv\u00e1s sz\u0171r\u0151 alkalmaz\u00e1s\u00e1ra ker\u00fcl sor, amely megnehez\u00edti a kernel sebezhet\u0151s\u00e9geinek tov\u00e1bbi kihaszn\u00e1l\u00e1s\u00e1t. A Pixel 9 firmware-j\u00e9ben hasonl\u00f3 sz\u0171r\u0151 nem volt jelen. a t\u00e1mad\u00e1sok ellen v\u00e9delmet ny\u00fajtana<\/a> A Memory Tagging (MTE) mechanizmus, de csak a Pixel 8+ eszk\u00f6z\u00f6k\u00f6n \u00e9rhet\u0151 el, mint opci\u00f3, amelyet az \u201eAdvanced Protection\u201d m\u00f3d bekapcsol\u00e1sakor aktiv\u00e1lnak. A macOS \u00e9s iOS rendszerekben a sebezhet\u0151s\u00e9g kihaszn\u00e1l\u00e1s\u00e1t megnehez\u00edti a k\u00f6nyvt\u00e1r -fbounds-safet kapcsol\u00f3val t\u00f6rt\u00e9n\u0151 ford\u00edt\u00e1sa, amely tov\u00e1bbi ellen\u0151rz\u00e9seket vezet be a t\u00f6mbhat\u00e1rok t\u00fall\u00e9p\u00e9s\u00e9nek elker\u00fcl\u00e9s\u00e9re, cs\u00f6kkentve ezzel a teljes\u00edtm\u00e9nyt. <\/p>\n A kutat\u00f3k k\u00fcl\u00f6n vizsg\u00e1lj\u00e1k a Dolb Unified Decoder sebezhet\u0151s\u00e9g\u00e9nek jav\u00edt\u00e1s\u00e1val kapcsolatos probl\u00e9m\u00e1kat. A sebezhet\u0151s\u00e9g r\u00e9szleteit 82 nappal a Pixel eszk\u00f6z\u00f6kre vonatkoz\u00f3 jav\u00edt\u00e1s el\u00e9rhet\u0151s\u00e9ge el\u0151tt nyilv\u00e1nosan hozt\u00e1k nyilv\u00e1noss\u00e1gra. A Dolby c\u00e9get 2025. j\u00fanius 26-\u00e1n t\u00e1j\u00e9koztatt\u00e1k a probl\u00e9m\u00e1r\u00f3l. Az els\u0151 bin\u00e1ris jav\u00edt\u00e1st 2025. szeptember 18-\u00e1n adt\u00e1k ki ChromeOS-re, de az Android eszk\u00f6z\u00f6kh\u00f6z a Dolby csak 2025. okt\u00f3ber 8-\u00e1n biztos\u00edtott bin\u00e1ris jav\u00edt\u00e1sokat. Az sebezhet\u0151s\u00e9g nyilv\u00e1nos felfed\u00e9se 2025. okt\u00f3ber 15-\u00e9n t\u00f6rt\u00e9nt. A Samsung 2025. november 12-\u00e9n kiadta a jav\u00edt\u00e1st, \u00e9s csak 2026. janu\u00e1r 5-\u00e9n publik\u00e1lt\u00e1k a jav\u00edt\u00e1st a Pixel eszk\u00f6z\u00f6kh\u00f6z. A jav\u00edt\u00f3csomag minden Android-ra val\u00f3 eljuttat\u00e1sa 139 napot vett ig\u00e9nybe. <\/p>\n A Dolby Unified Decoderben a sebezhet\u0151s\u00e9get kevesebb mint k\u00e9t nap alatt azonos\u00edtott\u00e1k, m\u00edg a BigWave meghajt\u00f3 eset\u00e9ben ez kevesebb mint egy napot vett ig\u00e9nybe a fel\u00fclvizsg\u00e1lat sor\u00e1n. A Dolby Unified Decoder sebezhet\u0151s\u00e9g\u00e9nek m\u0171k\u00f6d\u0151 exploitj\u00e1nak kifejleszt\u00e9s\u00e9hez egy kutat\u00f3 eset\u00e9n 8 h\u00e9t sz\u00fcks\u00e9ges, m\u00edg a BigWave eset\u00e9ben 3 h\u00e9tre becs\u00fclt\u00e9k. A Dolby 14-\u00e9n k\u00f6zz\u00e9tett jelent\u00e9s\u00e9ben a Dolby Unified Decoder sebezhet\u0151s\u00e9g\u00e9t alacsony kock\u00e1zati szinttel jel\u00f6lt\u00e9k, annak ellen\u00e9re, hogy r\u00e9szleteket k\u00f6z\u00f6ltek a kidolgoz\u00e1s alatt \u00e1ll\u00f3 exploit k\u00f6r\u00fcl. A BigWave sebezhet\u0151s\u00e9ge az Androidban k\u00f6zepes kock\u00e1zati szintet kapott, mivel a t\u00e1mad\u00e1s csak privil\u00e9giumokkal rendelkez\u0151 tartalomb\u00f3l lehets\u00e9ges, \u00e9s nem el\u00e9rhet\u0151 a nem privil\u00e9giz\u00e1lt k\u00f6rnyezetekb\u0151l (h\u00e1rom h\u00f3nappal k\u00e9s\u0151bb a sebezhet\u0151s\u00e9g st\u00e1tusz\u00e1t \u201evesz\u00e9lyes probl\u00e9ma\u201d szintre m\u00f3dos\u00edtott\u00e1k). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0432\u0443\u043a\u043e\u0432\u044b\u043c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \u0410\u0442\u0430\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f. \u0412 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-153878","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9g az Android firmware-ben, amely lehet\u0151v\u00e9 teszi a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t \u00fczenetk\u00fcld\u00e9ssel | ProHoster","description":"A Google Project Zero csapat kutat\u00f3i r\u00e9szletesen megvizsg\u00e1lt\u00e1k a m\u00f3dszert, amellyel m\u0171k\u00f6d\u0151 exploitot lehet l\u00e9trehozni, amely lehet\u0151v\u00e9 teszi, hogy t\u00e1volr\u00f3l futtass\u00e1k a saj\u00e1t k\u00f3djukat Linux kernel jogokkal, SMS- vagy RCS-\u00fczenet k\u00fcld\u00e9s\u00e9vel, amelyet k\u00fcl\u00f6nleges m\u00f3don alak\u00edtottak ki.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-17T09:12:33+00:00","article:modified_time":"2026-01-17T09:12:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"153878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 15:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 14:13:19","updated":"2026-01-24 15:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/153878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=153878"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/153878\/revisions"}],"predecessor-version":[{"id":154931,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/153878\/revisions\/154931"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=153878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=153878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=153878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"