CVE-2025-1413 json
Dylib Hijacking in DaVinci Resolve
published 2025-02-28 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-5501
- cvss
- 8.4
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.
Patch / fix
- Blackmagic Design Inc DaVinci Resolve 19.1.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N |
| CNA | 4.0 | 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Blackmagic Design Inc DaVinci Resolve
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
-
cert.pl
/en/posts/2025/02/CVE-2025-1413/
third-party-advisory
-
cert.pl
/posts/2025/02/CVE-2025-1413/
third-party-advisory
-
apps.apple.com
/pl/app/davinci-resolve/id571213070?mt=12
product
Sources
- CVE List CVE-2025-1413
- NVD CVE-2025-1413
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.