CVE-2010-3000

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-08-30 · updated 2026-06-16
Weakness: CWE-189

Description

Multiple integer overflows in the ParseKnownType function in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows allow remote attackers to execute arbitrary code via crafted (1) HX_FLV_META_AMF_TYPE_MIXEDARRAY or (2) HX_FLV_META_AMF_TYPE_ARRAY data in an FLV file.

Affected products

RealNetworks Realplayer: 11.0, 11.1
RealNetworks Realplayer Sp: 1.0.0, 1.0.1, 1.0.2, 1.0.5, 1.1, 1.1.1 (+3)

References

http://secunia.com/advisories/41096
http://secunia.com/advisories/41154
http://service.real.com/realplayer/security/08262010_player/en/
http://www.securityfocus.com/archive/1/513383/100/0/threaded
http://www.securitytracker.com/id?1024370
http://www.vupen.com/english/advisories/2010/2216
http://www.zerodayinitiative.com/advisories/ZDI-10-167
https://exchange.xforce.ibmcloud.com/vulnerabilities/61423
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6651
http://secunia.com/advisories/41096
http://secunia.com/advisories/41154
http://service.real.com/realplayer/security/08262010_player/en/

Get alerted when CVE-2010-3000 or the next vulnerability affects your stack