PT-2025-23167 · Blackmagic Design · Davinci Resolve

Karol Mazurek · Published 2025-05-29 · Updated 2025-05-30 · CVE-2025-4081

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DaVinci Resolve versions prior to the fixed version

Description The issue is related to the use of entitlement "com.apple.security.cs.disable-library-validation" and the lack of launch and library load constraints, allowing a local attacker with unprivileged access to substitute a legitimate dynamic library with a malicious one. This enables the attacker to bypass Transparency, Consent, and Control (TCC) and execute the application with altered dynamic library. The acquired resource access is limited to previously granted permissions by the user, and access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission.

Recommendations For DaVinci Resolve, update to a version that includes the fix for this issue, as the current version 19.1.3 is affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-4081

Affected Products

Davinci Resolve

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-4081 · Security Note
• https://t.me/cvetracker/24901 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1928131749365571727 · Twitter Post
• https://twitter.com/CVEnew/status/1928098277058109691 · Twitter Post
• https://blackmagicdesign.com/products/davinciresolve · Note
• https://cert.pl/en/posts/2025/05/tcc-bypass · Note
• https://twitter.com/SystemTek_UK/status/1928463227651862977 · Twitter Post