← Vulnerability feed

Vulnerability record · CVE-2021-40418 · published 22 December 2021

CVE-2021-40418: Blackmagicdesign davinci resolve use of uninitialized resource vulnerability

Blackmagicdesign · Davinci Resolve

When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. Upon destruction of the object that owns it, the uninitialized member will be dereferenced and then destroyed using the object’s virtual destructor. Due to the object property being uninitialized, this can result in dereferencing an arbitrary pointer for the object’s virtual method table, which can result in code execution under the context of the application.

9.8 CVSS 3.1 Critical EPSS 18% · top 2.9% CWE-457 · CWE-457CWE-908 · Use of uninitialized resource
9.8CVSS 3.1 base score, v2 7.5
18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. Upon destruction of the object that owns it, the uninitialized member will be dereferenced and then destroyed using the object’s virtual destructor. Due to the object property being uninitialized, this can result in dereferencing an arbitrary pointer for the object’s virtual method table, which can result in code execution under the context of the application.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1427 ExploitThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1427 ExploitThird Party Advisory

Track CVE-2021-40418 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40417Blackmagicdesign davinci resolve integer overflow vulnerabilityWhen parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submit…EPSS 16%9.3CVE-2025-5777Citrix NetScaler ADC/Gateway memory overread via insufficient input validationCVE-2025-5777 is an insufficient input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that causes a memory overread when the appliance…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2021-40418), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.