Dylib Hijacking in DaVinci Resolve
Priority LOW 38CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed DaVinci Resolve (Blackmagic Design Inc): 19.1.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Blackmagic Design | DaVinci Resolve | before 19.1.3 | 19.1.3 | Patch available | CNA |
- DaVinci Resolve VendorBlackmagic Design Affected before 19.1.3 Fixed in 19.1.3 Patch available CNA
Remediation
- Fix · CNA DaVinci Resolve (Blackmagic Design Inc) Fixed in 19.1.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1413
- 2026-10-03 Alias added: GHSA-47m3-cr54-pvmq
References
More Blackmagic Design vulnerabilities
- TI-2025-35544 The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration… CVSS 3.1CRITICAL 9.8
- TI-2025-35540 The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an… CVSS 3.1CRITICAL 9.8
- TI-2025-35537 Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts… CVSS 3.1CRITICAL 9.8
- TI-2021-17482 Use of uninitialized resource in Blackmagic Design CVSS 3.1CRITICAL 9.8
- TI-2021-17481 Integer overflow in Blackmagic Design CVSS 3.1CRITICAL 9.8
- TI-2025-03621 TCC Bypass via Dylib Substitution in DaVinci Resolve CVSS 4.0MEDIUM 4.8
Sources
- CVE-2025-1413 · CVE Program
- CVE-2025-1413 · NVD
- FIRST EPSS
- GHSA-47m3-cr54-pvmq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences