Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

RealPlayer can run attacker code via crafted file

CVE-2009-4241 · published 16 years ago
Summary

Several versions of RealPlayer and Helix Player may be tricked by a specially crafted media file that corrupts memory. This can let a remote attacker execute their own code on the computer. Update to the latest patches or replace the affected players to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
realnetworks realplayer 11.0.1
10.0
10.5
11.0
11.0.2
11.0.3
11.0.4
11.0.5
10.1
11.0.0
cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*
realnetworks realplayer_enterprise All versions
cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*
realnetworks realplayer_sp 1.0.0
1.0.1
cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*
realnetworks helix_player 10.0
11.0.0
11.0.1
cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Li...
Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a file with invalid ASMRuleBook structures that trigger heap memory corruption.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published25 Jan 2010
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-4241 · NVD
Track software like this
Free during beta