Vulnerability · Published Feb 28, 2025 · Assigned by CERT-PL

CVE-2025-1413Dylib Hijacking in DaVinci Resolve

High 8.4

In plain English

A high-severity incorrect permission assignment in DaVinci Resolve from Blackmagic Design Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.2%top 89.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.

Affected products (as reported)

Vendor	Product	Versions
Blackmagic Design Inc	DaVinci Resolve	0 – before 19.1.3

Weakness: CWE-732 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/en/posts/2025/02/CVE-2025-1413/ third-party-advisory
https://cert.pl/posts/2025/02/CVE-2025-1413/ third-party-advisory
https://apps.apple.com/pl/app/davinci-resolve/id571213070?mt=12 product