CVE-2010-4376

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-12-14 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a large Screen Width value in the Screen Descriptor header of a GIF87a file in an RTSP stream.

Affected products

RealNetworks Realplayer: 11.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5 (+2)
RealNetworks Realplayer Sp: 1.0.0, 1.0.1, 1.0.2, 1.0.5, 1.1, 1.1.1

References

http://service.real.com/realplayer/security/12102010_player/en/
http://www.securityfocus.com/bid/45411
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-271
http://service.real.com/realplayer/security/12102010_player/en/
http://www.securityfocus.com/bid/45411
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-271

Get alerted when CVE-2010-4376 or the next vulnerability affects your stack