Vulnerability Spotlight: Vulnerabilities in DaVinci Resolve video editing software

guest · Dec 21, 2021

December 20, 2021

Cisco Talos recently discovered two vulnerabilities in the DaVinci Resolve video editing software that could allow an adversary to execute code in the context of the application.

DaVinci Resolve is a non-linear video editing application from Blackmagic Software that is available on multiple operating systems. Both these vulnerabilities exist in the DPDecoder service inside DaVinci Resolve.
Click to expand...

TALOS-2021-1426 (CVE-2021-40417) is a heap-based buffer overflow vulnerability that occurs when the application faces an integer overflow condition that leads to a sign extension while trying to decode a video file. Alternatively, TALOS-2021-1427 (CVE-2021-40418) could also lead to code execution, but is instead triggered as the result of an uninitialized object member as a result of an incorrect UUID.
Click to expand...

Users are encouraged to update these affected products as soon as possible: Blackmagic Design DaVinci Resolve, version 17.3.1.0005 tested and confirmed these versions of DaVinci could be exploited by this vulnerability.
Click to expand...

Log in or Sign up

Vulnerability Spotlight: Vulnerabilities in DaVinci Resolve video editing software

guest Guest

Log in or Sign up

Vulnerability Spotlight: Vulnerabilities in DaVinci Resolve video editing software

guest Guest

Useful Searches