Vulnerability record · CVE-2012-5691 · published 19 December 2012
CVE-2012-5691: RealPlayer buffer overflow via crafted RealMedia file
RRealnetworks · Realplayer
RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 contain a memory buffer overflow (CWE-119) triggered by a crafted RealMedia file. Because the flaw is reachable remotely and leads to code execution, it is a serious risk for users who open untrusted media.
Description
Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted RealMedia file.
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote code execution with high EPSS and no authentication, though it requires the user to open a crafted media file and no KEV or public exploit is documented.
What it is
RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 contain a memory buffer overflow (CWE-119) triggered by a crafted RealMedia file. Because the flaw is reachable remotely and leads to code execution, it is a serious risk for users who open untrusted media.
Impact
An attacker can execute arbitrary code in the context of the user running RealPlayer, giving full control of confidentiality, integrity and availability on the affected host.
Attack surface
The vector is network-reachable (AV:N) with medium attack complexity and no authentication required, but exploitation depends on the victim opening a malicious RealMedia file, so user interaction is effectively required.
Exploitation
No CISA KEV listing and no public exploit references are present; EPSS is high (0.52703, 98.9th percentile), indicating elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.
What to do
- Upgrade RealPlayer to 16.0.0.282 or later, and RealPlayer SP to a fixed release, per the vendor advisory
- Remove or block RealPlayer on systems that do not require it
- Block or quarantine untrusted RealMedia files at email and web gateways
- Restrict user privileges so a successful exploit cannot gain administrative rights
- Monitor vendor advisories for updated fixed versions
Detection
- Alert on RealPlayer processes spawning unexpected child processes or writing executables to user directories
- Detect RealPlayer crashes or buffer-overflow exceptions in endpoint logs
- Scan email and web proxy logs for RealMedia attachments or downloads from untrusted sources
- Inventory endpoints still running RealPlayer versions below 16.0.0.282
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://service.real.com/realplayer/security/12142012_player/en/ | Vendor Advisory |
| http://service.real.com/realplayer/security/12142012_player/en/ | Vendor Advisory |
Track CVE-2012-5691 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-5691), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
