EIP-2026-117835
PRE-CVEReal Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-117835. PoCs published by Eduardo Braun Prado.
AI-analyzed exploit summary This exploit leverages a directory traversal vulnerability in Real Player's 'external::Import()' method to achieve remote code execution by planting arbitrary files (e.g., 'shdoclc.dll' and 'write.exe') in sensitive locations like the 'startup' folder. The attack requires hosting malicious files on an SMB or WebDav share and exploits unsafe file type handling and path sanitization.
Description
Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)
Exploits (1)
This exploit leverages a directory traversal vulnerability in Real Player's 'external::Import()' method to achieve remote code execution by planting arbitrary files (e.g., 'shdoclc.dll' and 'write.exe') in sensitive locations like the 'startup' folder. The attack requires hosting malicious files on an SMB or WebDav share and exploits unsafe file type handling and path sanitization.