EIP-2026-119083

PRE-CVE

RealNetworks RealGames StubbyUtil.ShellCtl.1 - ActiveX Control Multiple Remote Command Executions

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-119083. PoCs published by rgod.

AI-analyzed exploit summary The exploit demonstrates multiple remote command execution vulnerabilities in the RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX control. It highlights insecure methods like ShellExec, ShellExecRunAs, CreateShortcut, and CopyDocument that allow arbitrary command execution and file manipulation.

Description

RealNetworks RealGames StubbyUtil.ShellCtl.1 - ActiveX Control Multiple Remote Command Executions

Exploits (1)

exploitdb WORKING POC VERIFIED
by rgod · textremotewindows
https://www.exploit-db.com/exploits/17104

The exploit demonstrates multiple remote command execution vulnerabilities in the RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX control. It highlights insecure methods like ShellExec, ShellExecRunAs, CreateShortcut, and CopyDocument that allow arbitrary command execution and file manipulation.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: RealNetworks RealGames InstallerDlg.dll v2.6.0.445
No auth needed
Prerequisites: Victim must visit a malicious webpage using Internet Explorer with the vulnerable ActiveX control installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026