Summary of CVE-2025-1413 Vulnerability in DaVinci Resolve
CVE Identifier: CVE-2025-1413
Publication Date: February 28, 2025
Supplier: Blackmagic Design Inc
Product: DaVinci Resolve
Vulnerable Versions: All versions prior to 19.1.3
Vulnerability Type (CWE): Incorrect Permission Assignment (CWE-266)
Reporting Source: CERT Polska
The vulnerability identified as CVE-2025-1413 pertains to the DaVinci Resolve software produced by Blackmagic Design, specifically affecting its installation on MacOS systems. This report is based on findings submitted to CERT Polska, which handled the coordination of disclosing the vulnerability.
Description of the Vulnerability
The vulnerability arises from improper file permissions assigned to the DaVinci Resolve application installed on MacOS. It was found that the application possessed overly permissive file access rights (RWXRWXRWX), which starkly contrasts with the standard security protocols recommended for MacOS applications. According to MacOS security norms, applications should have file permissions set to (DRWXR-XR-X).
This discrepancy creates a security weakness as it opens the door for potential exploitation. Notably, this weakness allows for the hijacking of dynamic libraries (Dylib files). Users operating with guest accounts or those with limited privileges, as well as other applications, can exploit this vulnerability for an elevation of access rights, potentially leading to unauthorized operations within the system.
Impact of the Vulnerability
The implications of CVE-2025-1413 specifically affect DaVinci Resolve versions before 19.1.3. Given that the vulnerability enables privilege escalation, it poses a significant risk to users who have not updated their software. Attackers could manipulate the permissions to gain unauthorized control, potentially jeopardizing the integrity and security of user data and system functions.
Acknowledgments
The discovery of this critical vulnerability is credited to Karol Mazurek from Afine, who conducted a responsible disclosure of the issue. This highlights the importance of an active collaboration between security researchers and software providers in ensuring the safety of users.
For further details on this vulnerability and the coordinated disclosure process, information is available through CERT Polska’s website (https://cert.pl/en/cvd/).
This summary provides essential insights into the nature of the vulnerability, its potential impact, and the significance of maintaining updated software to safeguard user systems from malicious exploitation. Updating to DaVinci Resolve version 19.1.3 or later is strongly advised for all users to mitigate this risk.