CVE-2010-3747
Realnetworks Realplayer - Memory Corruption
Title source: ruleDescription
An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16998
metasploit
WORKING POC
NORMAL
by bannedit, sinn3r · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/realplayer_cdda_uri.rb
References (4)
Scores
EPSS
0.6653
EPSS Percentile
98.5%
Details
CWE
CWE-119
Status
published
Products (17)
realnetworks/realplayer
11.0
realnetworks/realplayer
11.0.1
realnetworks/realplayer
11.0.2
realnetworks/realplayer
11.0.3
realnetworks/realplayer
11.0.4
realnetworks/realplayer
11.0.5
realnetworks/realplayer
11.1
realnetworks/realplayer
2.1.2
realnetworks/realplayer_sp
1.0.0
realnetworks/realplayer_sp
1.0.1
... and 7 more
Published
Oct 19, 2010
Tracked Since
Feb 18, 2026