← Vulnerability feed

Vulnerability record · CVE-2021-40417 · published 22 December 2021

CVE-2021-40417: Blackmagicdesign davinci resolve integer overflow vulnerability

Blackmagicdesign · Davinci Resolve

When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation, this can result in an undersized heap buffer being allocated. When this heap buffer is written to, a heap-based buffer overflow will occur. This can result in code execution under the context of the application.

9.8 CVSS 3.1 Critical EPSS 16% · top 3.3% CWE-680 · CWE-680CWE-190 · Integer overflow
9.8CVSS 3.1 base score, v2 7.5
16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation, this can result in an undersized heap buffer being allocated. When this heap buffer is written to, a heap-based buffer overflow will occur. This can result in code execution under the context of the application.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1426 ExploitThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1426 ExploitThird Party Advisory

Track CVE-2021-40417 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40418Blackmagicdesign davinci resolve use of uninitialized resource vulnerabilityWhen parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containin…EPSS 18%

Source: NIST National Vulnerability Database (record CVE-2021-40417), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.