CVE-2011-2955

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-08-18 · updated 2026-06-16
Weakness: CWE-399

Description

Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via vectors related to a modal dialog.

Affected products

RealNetworks Realplayer: 11.0, 11.1, 14.0.0, 14.0.1, 14.0.2, 14.0.3 (+8)
RealNetworks Realplayer Sp: 1.0.0, 1.0.1, 1.0.2, 1.0.5, 1.1, 1.1.1 (+4)

References

http://service.real.com/realplayer/security/08162011_player/en/
http://www.securitytracker.com/id?1025943
http://service.real.com/realplayer/security/08162011_player/en/
http://www.securitytracker.com/id?1025943

Get alerted when CVE-2011-2955 or the next vulnerability affects your stack