CVE-2007-5601

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 42.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-10-20 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.

Affected products

RealNetworks Realplayer: 10.0, 10.5, 11_beta

References

http://secunia.com/advisories/27248
http://service.real.com/realplayer/security/191007_player/en/
http://www.infosecblog.org/2007/10/nasa-bans-ie.html
http://www.kb.cert.org/vuls/id/871673
http://www.securityfocus.com/bid/26130
http://www.securitytracker.com/id?1018843
http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html
http://www.us-cert.gov/cas/techalerts/TA07-297A.html
http://www.vupen.com/english/advisories/2007/3548
https://exchange.xforce.ibmcloud.com/vulnerabilities/37280
http://secunia.com/advisories/27248
http://service.real.com/realplayer/security/191007_player/en/

Get alerted when CVE-2007-5601 or the next vulnerability affects your stack