CVE-2005-2922: Realnetworks Helix Player

High severity, CVSS 9.3. EPSS: 5.8% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.

Affected products

• Realnetworks Helix Player: version 10.0 only; version 10.0.1 only; version 10.0.2 only; version 10.0.3 only; version 10.0.4 only; version 10.0.5 only; …
• Realnetworks Realone Player: any version; version 0.288 only; version 0.297 only; version 1.0 only; version 2.0 only
• Realnetworks Realplayer: any version; version 8.0 only; version 10.0 only; version 10.0.0.305 only; version 10.0.0.331 only; version 10.0.1 only; …
• Realnetworks Rhapsody: version 3.0 only; version 3.0_build_0.815 only

Published 2005-12-31. Last modified 2026-06-16.