CVE-2025-1413

Dylib Hijacking in DaVinci Resolve

CVSS 8.4 HIGHEPSS 0.2%CWE-732

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.4EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

28 feb 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Productos afectados

Blackmagic Design Inc · DaVinci Resolve

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://apps.apple.com/pl/app/davinci-resolve/id571213070?mt=12 https://cert.pl/en/posts/2025/02/CVE-2025-1413/https://cert.pl/posts/2025/02/CVE-2025-1413/