PT-2025-9078 · Blackmagic Design · Davinci Resolve

Karol Mazurkowi · Published 2025-02-28 · Updated 2025-02-28 · CVE-2025-1413

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DaVinci Resolve versions prior to 19.1.3

Description The issue is related to incorrect file permissions in DaVinci Resolve on MacOS, which can lead to Dylib Hijacking. This inconsistency with standard macOS security practices allows for privilege escalation, where the guest account, other users, and applications can exploit this issue.

Recommendations For versions prior to 19.1.3, update to version 19.1.3 or later to resolve the issue. As a temporary workaround, consider changing the file permissions to drwxr-xr-x to minimize the risk of exploitation. Restrict access to the application for guest accounts and other users to prevent privilege escalation until the update is applied.

Fix

LPE

Incorrect Privilege Assignment

Incorrect Permission

Weakness Enumeration

CWE-266

CWE-732

Related Identifiers

CVE-2025-1413

Affected Products

Davinci Resolve

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-1413 · Security Note
• https://twitter.com/CveFindCom/status/1895391363014836483 · Twitter Post
• https://twitter.com/CVEnew/status/1895619325362627064 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895459722540515752 · Twitter Post
• https://t.me/latest_high_impact_cve/1885 · Telegram Post
• https://t.me/cvedetector/19139 · Telegram Post
• https://apps.apple.com/pl/app/davinci-resolve/id571213070?mt=12 · Note
• https://cert.pl/posts/2025/02/CVE-2025-1413 · Note
• https://cert.pl/en/posts/2025/02/CVE-2025-1413 · Note