CVE-2025-4081
MEDIUM EPSS 2.8%
Published May 29, 20251y ago · Modified Jun 17, 20262w ago
4.8 CVSS 4.0
Published May 29, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altered dynamic library successfully bypassing Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue affects DaVinci Resolve on macOS in all versions. Last tested version: 19.1.3
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
2.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-276
References 2
- cert.pl https://cert.pl/en/posts/2025/05/tcc-bypass/
- blackmagicdesign.com https://www.blackmagicdesign.com/products/davinciresolve
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.