CVE-2010-2999

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-12-14 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed MLLT atom in an AAC file.

Affected products

RealNetworks Realplayer: 11.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5 (+2)
RealNetworks Realplayer Sp: 1.0.0, 1.0.1

References

http://service.real.com/realplayer/security/12102010_player/en/
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-273
http://service.real.com/realplayer/security/12102010_player/en/
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-273

Get alerted when CVE-2010-2999 or the next vulnerability affects your stack