Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

RealPlayer 18.1.5.x < (Win) RCE



The remote host is running a version of RealPlayer multimedia application that may be vulnerable to a Remote Code Execution (RCE) attack vector.


Versions of RealPlayer 18.1.5.x prior to on Windows are potentially affected by a flaw that is triggered when loading certain dynamic-link libraries. The program uses an insecure path to look for specific files or libraries that includes the current working directory, which may not be trusted or under user control. By placing a specially crafted library in the path, a local attacker can inject and execute arbitrary code with the privilege of the user running the program.


Windows users should upgrade to RealPlayer or later.