EIP-2026-102967

This exploit leverages insecure group-writable permissions on RealOne Player 9 configuration files to replace a shared library (cook.so.6.0) with a malicious version. When the victim runs RealPlayer, it executes the trojaned library, which binds a shell to port 12345, allowing privilege escalation to the victim's user context.