RCE in Realnetworks Realplayer

CVE-2011-4256

The RV30 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 does not initialize an unspecified index value, which allows remote attackers to execute arbitrary code via unknown vectors.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.043 (90.0th percentile) — read the EPSS interpretation.

Affected products

Realnetworks Realplayer — versions 7.0, 8.0, 10.0
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)