CVE-2005-0455: RealPlayer SMIL parser stack buffer overflow via system-screen-size

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication required and a very high EPSS score, though exploitation requires user interaction and high attack complexity.

What it is

RealNetworks RealPlayer and RealOne Player contain a stack-based buffer overflow in CSmil1Parser::testAttributeFailed in smlparse.cpp. A .SMIL file with an oversized system-screen-size value overflows a stack buffer, allowing remote code execution. The flaw affects RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1.

Impact

An attacker can execute arbitrary code in the context of the user running the affected player. This gives full control of the process and potentially the host, depending on user privileges.

Attack surface

Reached remotely over the network when a victim opens or plays a malicious .SMIL file; no authentication is required, but user interaction is needed to load the file. The CVSS vector AV:N/AC:H/Au:N indicates network reachability with high attack complexity and no authentication.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is 0.5399 (98.95th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the vendor patch from RealNetworks (service.real.com security advisory 050224_player) or the relevant Red Hat errata (RHSA-2005-265, RHSA-2005-271) for affected Linux packages.
• Upgrade to a fixed RealPlayer/RealOne build; do not rely on version 10.5 (6.0.12.1056) or earlier.
• Block or restrict automatic handling of .SMIL files and untrusted SMIL content at mail and web gateways.
• Where the player is not required, remove or disable RealPlayer/RealOne on endpoints.
• Educate users not to open SMIL files from untrusted sources.

Detection

• Monitor for RealPlayer/RealOne processes spawning unexpected child processes or making outbound network connections after opening SMIL content.
• Inspect SMIL files for unusually large system-screen-size attribute values.
• Use the OVAL definition oval:org.mitre.oval:def:10926 to check for vulnerable installations.
• Review endpoint logs for crashes or memory corruption in smlparse.cpp-related modules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.