← Vulnerability feed

Vulnerability record · CVE-2004-0389 · published 1 June 2004

CVE-2004-0389: RealNetworks Helix Universal Server null dereference DoS via malformed RTSP requests

RRealnetworks · Helix Universal Server

RealNetworks Helix Universal Server 9.0.1 and 9.0.2 crashes on malformed requests that trigger a null pointer dereference. The flaw is reachable over the network without authentication and only causes a denial of service, not code execution or data exposure.

7.5 CVSS 3.1 High EPSS 55% · top 1.0% CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score, v2 7.8
55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated denial of service with a high EPSS score and public exploit references, though impact is limited to availability.

What it is

RealNetworks Helix Universal Server 9.0.1 and 9.0.2 crashes on malformed requests that trigger a null pointer dereference. The flaw is reachable over the network without authentication and only causes a denial of service, not code execution or data exposure.

Impact

An attacker can crash the server process, disrupting streaming services for all users until it is restarted. No confidentiality or integrity impact is described.

Attack surface

Reachable remotely over the network via crafted GET_PARAMETER or DESCRIBE requests, per the description and CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.549, ~99th percentile) and reference tags include Exploit, indicating public exploit information exists.

What to do

  • Upgrade Helix Universal Server to a version later than 9.0.2 that fixes the null dereference.
  • If patching is not possible, restrict network access to the RTSP service to trusted sources only.
  • Run the service under a supervisor that restarts it automatically after a crash to limit downtime.
  • Monitor vendor advisories for updated guidance and apply any available hotfixes.

Detection

  • Inspect RTSP logs for malformed or unusually formed GET_PARAMETER and DESCRIBE requests.
  • Alert on unexpected Helix Universal Server process crashes or restarts.
  • Baseline normal RTSP request patterns and flag deviations from known clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/11395 Broken LinkVendor Advisory
http://www.idefense.com/application/poi/display?id=102&type=vulnerabilities Broken LinkExploitPatchVendor Advisory
http://www.securityfocus.com/bid/10157 Broken LinkExploitThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15880 Third Party AdvisoryVDB Entry
http://secunia.com/advisories/11395 Broken LinkVendor Advisory
http://www.idefense.com/application/poi/display?id=102&type=vulnerabilities Broken LinkExploitPatchVendor Advisory
http://www.securityfocus.com/bid/10157 Broken LinkExploitThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15880 Third Party AdvisoryVDB Entry

Track CVE-2004-0389 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2004-0774Realnetworks helix universal mobile server and gateway vulnerabilityRealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaus…EPSS 1.9%7.5CVE-2003-0725RealNetworks Helix/RealServer RTSP parser buffer overflowThe RTSP protocol parser in the View Source plug-in (vsrcplin.so / vsrcplin3260.dll) shipped with RealNetworks Helix Universal Server 9 and RealSyste…EPSS 49%analysed7.5CVE-2002-1643RealNetworks Helix Universal Server RTSP/HTTP buffer overflows allow remote code executionRealNetworks Helix Universal Server 9.0 (9.0.2.768) contains multiple buffer overflows reachable over the network. A long Transport field in a SETUP …EPSS 75%analysed6.8CVE-2004-0049Realnetworks helix universal mobile server vulnerabilityHelix Universal Server/Proxy 9 and Mobile Server 10 allow remote attackers to cause a denial of service via certain HTTP POST messages to the Adminis…EPSS 1.5%6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2004-0389), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.